Add two profiles directory to have smaller dir.

This commit is contained in:
Alexandre Pujol 2021-09-15 16:55:27 +01:00
parent 6c0ae4ddc1
commit d95a876424
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
521 changed files with 0 additions and 0 deletions

View file

@ -0,0 +1,63 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/{kmod,lsmod}
@{exec_path} += /{usr/,}{s,}bin/{depmod,insmod,lsmod,rmmod,modinfo,modprobe}
profile kmod @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
# To load/unload kernel modules
# modprobe: ERROR: could not insert '*': Operation not permitted
#
# modprobe: ERROR: ../libkmod/libkmod-module.c:799 kmod_module_remove_module() could not remove
# '*': Operation not permitted
capability sys_module,
# For error logs to go through the syslog mechanism (as LOG_DAEMON with level LOG_NOTICE) rather
# than to standard error.
capability syslog,
# Needed for static-nodes
capability dac_override,
unix (receive) type=stream,
@{exec_path} mr,
/{usr/,}lib/modprobe.d/{,*.conf} r,
/etc/modprobe.d/{,*.conf} r,
/etc/depmod.d/{,**} r,
/{usr/,}lib/modules/*/modules.* rw,
/var/lib/dkms/**/module/*.ko r,
/usr/src/*/*.ko r,
@{sys}/module/{,**} r,
@{PROC}/cmdline r,
@{PROC}/modules r,
# Initframs
owner /tmp/mkinitcpio.*/{,**} rw,
#owner @{PROC}/@{pid}/fd/1 w,
# For local kernel build
owner /tmp/depmod.*/lib/modules/*/ r,
owner /tmp/depmod.*/lib/modules/*/modules.* rw,
owner @{user_build_dirs}/**/System.map r,
owner @{user_build_dirs}/**/debian/*/lib/modules/*/ r,
owner @{user_build_dirs}/**/debian/*/lib/modules/*/modules.* rw,
owner @{user_build_dirs}/**/debian/*/lib/modules/*/kernel/{,**/} r,
owner @{user_build_dirs}/**/debian/*/lib/modules/*/kernel/**/*.ko r,
include if exists <local/kmod>
}