felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

update apparmor profiles

Browse source 
Co-authored-by: Mikhail Morfikov <mmorfikov@gmail.com>
Signed-off-by: Alexandre Pujol <alexandre@pujol.io>
This commit is contained in:
Alexandre Pujol 2022-02-27 01:22:35 +00:00
parent b0690c0e55
commit d701e39939
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
201 changed files with 540 additions and 608 deletions
Download patch file Download diff file Expand all files Collapse all files

16
apparmor.d/groups/apt/apt-listbugs
View file

@ -23,21 +23,25 @@ profile apt-listbugs @{exec_path} {
network netlink raw,
@{exec_path} r,
/{usr/,}bin/ruby2.[0-9]* rix,
/{usr/,}bin/ruby[0-9].[0-9]* rix,
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/logname rix,
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/logname rix,
/{usr/,}bin/apt-config rPx,
/{usr/,}bin/apt-config rPx,
# Do not strip env to avoid errors like the following:
# ERROR: ld.so: object 'libfakeroot-sysv.so' from LD_PRELOAD cannot be preloaded (cannot open
# shared object file): ignored.
/{usr/,}bin/dpkg-query rpx,
/{usr/,}bin/dpkg-query rpx,
/usr/local/lib/site_ruby/[0-9].[0-9].[0-9]/**.rb r,
/usr/share/rubygems-integration/*/specifications/ r,
/usr/share/rubygems-integration/*/specifications/* r,
/usr/share/rubygems-integration/*/specifications/*.gemspec rwk,
/{usr/,}lib/ruby/gems/*/specifications/ r,
/{usr/,}lib/ruby/gems/*/specifications/** r,
/{usr/,}lib/ruby/gems/*/specifications/**.gemspec rwk,
/etc/apt/listbugs/{,*} r,

8
apparmor.d/groups/apt/apt-listbugs-migratepins
View file

@ -13,10 +13,14 @@ profile apt-listbugs-migratepins @{exec_path} {
include <abstractions/ruby>
@{exec_path} r,
/{usr/,}bin/ruby2.[0-9]* rix,
/{usr/,}bin/ruby[0-9].[0-9]* rix,
/usr/share/rubygems-integration/*/specifications/ r,
/usr/share/rubygems-integration/*/specifications/* r,
/usr/share/rubygems-integration/*/specifications/*.gemspec rwk,
/{usr/,}lib/ruby/gems/*/specifications/ r,
/{usr/,}lib/ruby/gems/*/specifications/** r,
/{usr/,}lib/ruby/gems/*/specifications/**.gemspec rwk,
/etc/apt/preferences r,

2
apparmor.d/groups/apt/apt-listbugs-prefclean
View file

@ -13,7 +13,7 @@ profile apt-listbugs-prefclean @{exec_path} {
include <abstractions/ruby>
@{exec_path} r,
/{usr/,}bin/ruby2.[0-9]* rix,
/{usr/,}bin/ruby[0-9].[0-9]* rix,
/{usr/,}bin/date rix,
/{usr/,}bin/cat rix,

1
apparmor.d/groups/apt/apt-listchanges
View file

@ -79,6 +79,7 @@ profile apt-listchanges @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
capability dac_read_search,
#capability sys_tty_config,
/{usr/,}bin/sensible-pager mr,

1
apparmor.d/groups/apt/querybts
View file

@ -18,7 +18,6 @@ profile querybts @{exec_path} {
include <abstractions/openssl>
include <abstractions/ssl_certs>
include <abstractions/apt-common>
include <abstractions/deny-root-dir-access>
network inet dgram,
network inet6 dgram,

6
apparmor.d/groups/apt/reportbug
View file

@ -19,8 +19,6 @@ profile reportbug @{exec_path} {
include <abstractions/enchant>
include <abstractions/python>
include <abstractions/apt-common>
include <abstractions/deny-root-dir-access>
include <abstractions/deny-dconf>
network inet dgram,
network inet6 dgram,
@ -65,6 +63,10 @@ profile reportbug @{exec_path} {
/{usr/,}bin/run-parts rCx -> run-parts,
/{usr/,}bin/gpg rCx -> gpg,
include <abstractions/dconf>
owner @{run}/user/@{uid}/dconf/ rw,
owner @{run}/user/@{uid}/dconf/user rw,
# For sending additional information
/etc/** r,

1
apparmor.d/groups/apt/synaptic
View file

@ -16,7 +16,6 @@ profile synaptic @{exec_path} {
include <abstractions/freedesktop.org>
include <abstractions/apt-common>
include <abstractions/nameservice-strict>
include <abstractions/deny-dconf>
# To remove the following errors:
# W: chmod 0700 of directory /var/lib/apt/lists/partial failed - SetupAPTPartialDirectory