felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(profile): fixes some issues raised by tests.

Browse source
This commit is contained in:
Alexandre Pujol 2025-07-22 23:54:40 +02:00
parent b30abed34f
commit d8b1d1b4ae
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
4 changed files with 35 additions and 22 deletions
Download patch file Download diff file Expand all files Collapse all files

1
apparmor.d/abstractions/base.d/complete
View file

@ -10,6 +10,7 @@
# Allow to receive some signals from new well-known profiles # Allow to receive some signals from new well-known profiles
signal (receive) peer=btop, signal (receive) peer=btop,
signal (receive) peer=htop, signal (receive) peer=htop,
signal (receive) peer=pkill,
signal (receive) peer=sudo, signal (receive) peer=sudo,
signal (receive) peer=top, signal (receive) peer=top,
signal (receive) set=(cont,term,kill,stop) peer=systemd-shutdown, signal (receive) set=(cont,term,kill,stop) peer=systemd-shutdown,

38
apparmor.d/groups/utils/lsfd
View file

@ -11,15 +11,25 @@ profile lsfd @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
capability bpf,
capability checkpoint_restore, capability checkpoint_restore,
capability dac_read_search, capability dac_read_search,
capability net_admin,
capability sys_admin, capability sys_admin,
capability sys_chroot,
capability sys_ptrace, capability sys_ptrace,
capability sys_resource, capability sys_resource,
capability syslog, capability syslog,
network inet dgram,
network inet stream,
network inet6 dgram,
network inet6 raw,
network inet6 stream,
network inet6 stream,
network netlink dgram, network netlink dgram,
network netlink raw, network netlink raw,
network packet dgram,
ptrace read, ptrace read,
ptrace trace, ptrace trace,
@ -38,20 +48,20 @@ profile lsfd @{exec_path} flags=(attach_disconnected) {
@{sys}/kernel/cpu_byteorder r, @{sys}/kernel/cpu_byteorder r,
@{PROC}/ r, @{PROC}/ r,
@{PROC}/@{pid}/ r, @{PROC}/@{pid}/ r,
@{PROC}/@{pid}/comm r, @{PROC}/@{pid}/comm r,
@{PROC}/@{pid}/fd/ r, @{PROC}/@{pid}/fd/ r,
@{PROC}/@{pid}/fdinfo/@{int} r, @{PROC}/@{pid}/fdinfo/@{int} r,
@{PROC}/@{pid}/mountinfo r, @{PROC}/@{pid}/mountinfo r,
@{PROC}/@{pid}/net/* r, @{PROC}/@{pid}/net/* r,
@{PROC}/@{pid}/stat r, @{PROC}/@{pid}/stat r,
@{PROC}/@{pid}/task/ r, @{PROC}/@{pid}/syscall r,
@{PROC}/devices r, @{PROC}/@{pid}/task/ r,
@{PROC}/misc r, @{PROC}/devices r,
@{PROC}/partitions r, @{PROC}/misc r,
@{PROC}/tty/drivers r, @{PROC}/partitions r,
owner @{PROC}/@{pid}/syscall r, @{PROC}/tty/drivers r,
include if exists <local/lsfd> include if exists <local/lsfd>
} }

2
apparmor.d/groups/utils/lsipc
View file

@ -27,6 +27,8 @@ profile lsipc @{exec_path} {
@{PROC}/sysvipc/sem r, @{PROC}/sysvipc/sem r,
@{PROC}/sysvipc/shm r, @{PROC}/sysvipc/shm r,
/dev/mqueue/ r,
include if exists <local/lsipc> include if exists <local/lsipc>
} }

16
apparmor.d/profiles-m-r/mkinitramfs
View file

@ -93,14 +93,14 @@ profile mkinitramfs @{exec_path} {
owner /var/lib/kdump/initramfs-tools/** rw, owner /var/lib/kdump/initramfs-tools/** rw,
owner /var/lib/kdump/initrd.* rw, owner /var/lib/kdump/initrd.* rw,
/var/tmp/ r, /var/tmp/ r,
/var/tmp/mkinitramfs_@{rand6}/** w, /var/tmp/mkinitramfs_@{rand6}/** w,
/var/tmp/modules_@{rand6} rw, /var/tmp/modules_@{rand6} rw,
owner /var/tmp/mkinitramfs_@{rand6} rw, /var/tmp/mkinitramfs_@{rand6} rw,
owner /var/tmp/mkinitramfs_@{rand6}/ rw, /var/tmp/mkinitramfs_@{rand6}/ rw,
owner /var/tmp/mkinitramfs_@{rand6}/** rwl -> /var/tmp/mkinitramfs_@{rand6}/**, /var/tmp/mkinitramfs_@{rand6}/** rwl -> /var/tmp/mkinitramfs_@{rand6}/**,
owner /var/tmp/mkinitramfs-@{rand6} rw, /var/tmp/mkinitramfs-@{rand6} rw,
owner /var/tmp/mkinitramfs-*_@{rand6} rw, /var/tmp/mkinitramfs-*_@{rand6} rw,
owner /tmp/tmp.@{rand10}/mkinitramfs_@{rand6} rw, owner /tmp/tmp.@{rand10}/mkinitramfs_@{rand6} rw,
owner /tmp/tmp.@{rand10}/mkinitramfs_@{rand6}/ rw, owner /tmp/tmp.@{rand10}/mkinitramfs_@{rand6}/ rw,