felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): update kernerl-install.

Browse source
This commit is contained in:
Alexandre Pujol 2025-05-25 01:19:32 +02:00
parent 44970624e6
commit d8a37c728b
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
1 changed files with 17 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

28
apparmor.d/profiles-g-l/kernel-install
View file

@ -11,22 +11,19 @@ include <tunables/global>
profile kernel-install @{exec_path} { profile kernel-install @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>
include <abstractions/disks-read>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
capability sys_resource,
ptrace read peer=@{p_systemd},
@{exec_path} r, @{exec_path} r,
@{sh_path} rix, @{sh_path} rix,
@{coreutils_path} rix,
@{bin}/mountpoint rix,
@{bin}/sort rix,
@{bin}/rm rix,
@{bin}/mkdir rix,
@{bin}/cp rix,
@{bin}/chown rix,
@{bin}/chmod rix,
@{bin}/basename rix,
@{pager_path} rPx -> child-pager,
@{bin}/kmod rCx -> kmod, @{bin}/kmod rCx -> kmod,
@{bin}/mountpoint rix,
@{pager_path} rPx -> child-pager,
@{lib}/kernel/install.d/ r, @{lib}/kernel/install.d/ r,
@{lib}/kernel/install.d/@{int2}-*.install rix, @{lib}/kernel/install.d/@{int2}-*.install rix,
@ -37,6 +34,7 @@ profile kernel-install @{exec_path} {
@{lib}/os-release r, @{lib}/os-release r,
/etc/kernel/cmdline r, /etc/kernel/cmdline r,
/etc/kernel/tries r, /etc/kernel/tries r,
/etc/kernel/entry-token r,
/etc/machine-id r, /etc/machine-id r,
/etc/os-release r, /etc/os-release r,
/var/lib/dbus/machine-id r, /var/lib/dbus/machine-id r,
@ -50,14 +48,22 @@ profile kernel-install @{exec_path} {
owner /boot/loader/entries/ rw, owner /boot/loader/entries/ rw,
owner /boot/loader/entries/*.conf w, owner /boot/loader/entries/*.conf w,
owner /tmp/kernel-install.staging.@{rand6}/{,**} rw,
owner @{tmp}/sh-thd.* rw, owner @{tmp}/sh-thd.* rw,
@{PROC}/1/environ r,
@{PROC}/cmdline r, @{PROC}/cmdline r,
@{PROC}/sys/kernel/osrelease r,
profile kmod { profile kmod {
include <abstractions/base> include <abstractions/base>
include <abstractions/app/kmod> include <abstractions/app/kmod>
@{lib}/modules/*/modules.* w,
@{sys}/module/compression r,
include if exists <local/kernel-install_kmod> include if exists <local/kernel-install_kmod>
} }