felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profiles): general update.

Browse source
This commit is contained in:
Alexandre Pujol 2022-05-07 11:42:18 +01:00
parent 6aadd82293
commit da1b3e1f1c
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
26 changed files with 114 additions and 126 deletions
Download patch file Download diff file Expand all files Collapse all files

2
apparmor.d/groups/desktop/accounts-daemon
View file

@ -23,7 +23,7 @@ profile accounts-daemon @{exec_path} {
@{exec_path} mr,
/usr/share/accountsservice/{,**} r,
/usr/share/dbus-1/interfaces/org.freedesktop.DisplayManager.AccountsService.xml r,
/usr/share/dbus-1/interfaces/*.xml r,
/etc/gdm/ r,
/etc/gdm/custom.conf rw,

2
apparmor.d/groups/desktop/colord
View file

@ -41,7 +41,7 @@ profile colord @{exec_path} flags=(attach_disconnected) {
@{sys}/class/drm/ r,
@{sys}/class/video4linux/ r,
@{sys}/devices/pci[0-9]*/**/drm/card[0-9]/card[0-9]-{HDMI,VGA,LVDS,DP,eDP}-*/{enabled,edid} r,
@{sys}/devices/pci[0-9]*/**/drm/card[0-9]/card[0-9]-{HDMI,VGA,LVDS,DP,eDP,Virtual}-*/{enabled,edid} r,
@{sys}/devices/virtual/dmi/id/{sys_vendor,product_version,product_name} r,
owner @{PROC}/@{pid}/fd/ r,

2
apparmor.d/groups/gnome/gnome-control-center
View file

@ -33,6 +33,8 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
signal (send) set=(kill) peer=passwd,
@{exec_path} mr,
/{usr/,}bin/bash rUx,
/{usr/,}bin/bwrap rPUx,
/{usr/,}bin/gcm-viewer rix,
/{usr/,}bin/locale rix,

12
apparmor.d/groups/gvfs/gvfsd
View file

@ -1,6 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Mikhail Morfikov
# 2021 Alexandre Pujol <alexandre@pujol.io>
# Copyright (C) 2021-2022 Mikhail Morfikov
# Copyright (C) 2021-2022 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -14,11 +14,9 @@ profile gvfsd @{exec_path} {
@{exec_path} mr,
/{usr/,}bin/{,ba,da}sh rix,
# Don't strip env here.
/{usr/,}lib/gvfs/gvfsd-* rpx,
@{libexec}/gvfsd-* rpx,
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}lib/gvfs/gvfsd-* rpx,
@{libexec}/gvfsd-* rpx,
/usr/share/gvfs/{,**} r,

21
apparmor.d/groups/systemd/systemd-journald
View file

@ -1,6 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# 2021 Alexandre Pujol <alexandre@pujol.io>
# Copyright (C) 2019-2022 Mikhail Morfikov
# Copyright (C) 2021-2022 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -41,17 +41,18 @@ profile systemd-journald @{exec_path} {
@{run}/host/container-manager r,
@{run}/udev/data/c189:[0-9]* r, # for /dev/bus/usb/**
@{run}/udev/data/c10:224 r, # for /dev/tpm0
@{run}/udev/data/c24[0-9]:[0-9]* r,
@{run}/udev/data/+usb:* r,
@{run}/udev/data/+pci:* r,
@{run}/udev/data/+hid:* r,
@{run}/udev/data/+acpi:* r,
@{run}/udev/data/+scsi:* r,
@{run}/udev/data/+bluetooth:* r,
@{run}/udev/data/+usb-serial:* r,
@{run}/udev/data/+hid:* r,
@{run}/udev/data/+pci:* r,
@{run}/udev/data/+platform* r,
@{run}/udev/data/+scsi:* r,
@{run}/udev/data/+usb-serial:* r,
@{run}/udev/data/+usb:* r,
@{run}/udev/data/c10:224 r, # for /dev/tpm0
@{run}/udev/data/c189:[0-9]* r, # for /dev/bus/usb/**
@{run}/udev/data/c23[0-9]:[0-9]* r,
@{run}/udev/data/c24[0-9]:[0-9]* r,
@{sys}/devices/**/uevent r,
@{sys}/firmware/efi/efivars/SecureBoot-@{uuid} r,

9
apparmor.d/groups/systemd/systemd-oomd
View file

@ -7,9 +7,10 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}lib/systemd/systemd-oomd
profile systemd-oomd @{exec_path} {
profile systemd-oomd @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/systemd-common>
include <abstractions/dbus-strict>
capability dac_override,
capability kill,
@ -18,7 +19,13 @@ profile systemd-oomd @{exec_path} {
/etc/systemd/oomd.conf r,
owner @{run}/systemd/notify rw,
owner @{run}/systemd/journal/socket w,
@{run}/systemd/io.system.ManagedOOM rw,
@{sys}/fs/cgroup/cgroup.controllers r,
@{sys}/fs/cgroup/memory.pressure r,
@{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/memory.* r,
@{PROC}/pressure/{cpu,io,memory} r,

4
apparmor.d/groups/systemd/systemd-random-seed
View file

@ -15,10 +15,14 @@ profile systemd-random-seed @{exec_path} {
@{exec_path} mr,
/etc/machine-id r,
/var/lib/systemd/ r,
/var/lib/systemd/random-seed rw,
@{PROC}/sys/kernel/random/poolsize r,
/dev/urandom w,
include if exists <local/systemd-random-seed>
}

25
apparmor.d/groups/systemd/systemd-resolved
View file

@ -1,17 +1,19 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2020 krathalan https://git.sr.ht/~krathalan/apparmor-profiles/
# 2021 Alexandre Pujol <alexandre@pujol.io>
# Copyright (C) 2021-2022 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-3.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}lib/systemd/systemd-resolved
profile systemd-resolved @{exec_path} {
profile systemd-resolved @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/dbus-strict>
include <abstractions/nameservice-strict>
include <abstractions/p11-kit>
include <abstractions/ssl_certs>
include <abstractions/systemd-common>
capability net_bind_service,
capability net_raw,
@ -28,20 +30,13 @@ profile systemd-resolved @{exec_path} {
@{exec_path} mr,
# Runtime directories
/{,var/}run/systemd/netif/links/* r,
/{,var/}run/systemd/resolve/{,**} rw,
# Config
/etc/systemd/resolved.conf r,
/etc/systemd/resolved.conf.d/{,*} r,
# Proc
owner @{PROC}/*/stat r,
@{PROC}/cmdline r,
@{PROC}/sys/kernel/hostname r,
@{PROC}/sys/kernel/osrelease r,
owner @{run}/systemd/journal/socket w,
owner @{run}/systemd/notify rw,
@{run}/systemd/netif/links/* r,
@{run}/systemd/resolve/{,**} rw,
# System access
@{sys}/firmware/efi/efivars/SecureBoot-@{uuid} r,
include if exists <local/systemd-timesyncd>
}

14
apparmor.d/groups/systemd/systemd-timesyncd
View file

@ -1,6 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# 2021 Alexandre Pujol <alexandre@pujol.io>
# Copyright (C) 2019-2022 Mikhail Morfikov
# Copyright (C) 2021-2022 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -8,13 +8,11 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}lib/systemd/systemd-timesyncd
profile systemd-timesyncd @{exec_path} {
profile systemd-timesyncd @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/systemd-common>
include <abstractions/nameservice-strict>
network inet dgram,
network inet6 dgram,
include <abstractions/systemd-common>
include <abstractions/dbus-strict>
capability sys_time,
@ -29,6 +27,8 @@ profile systemd-timesyncd @{exec_path} {
owner /var/lib/systemd/timesync/clock rw,
owner @{run}/systemd/journal/socket w,
owner @{run}/systemd/notify rw,
owner @{run}/systemd/timesync/synchronized rw,
@{run}/systemd/netif/state r,
@{run}/resolvconf/*.conf r,

1
apparmor.d/groups/systemd/systemd-update-utmp
View file

@ -20,6 +20,7 @@ profile systemd-update-utmp @{exec_path} {
@{exec_path} mr,
@{run}/host/container-manager r,
@{run}/systemd/private rw,
include if exists <local/systemd-update-utmp>
}