felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(fsp): reorganise systemd.service.

Browse source
This commit is contained in:
Alexandre Pujol 2024-02-01 18:33:19 +00:00
parent 0a74d5c6fe
commit dbbb2150e2
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
4 changed files with 10 additions and 96 deletions
Download patch file Download diff file Expand all files Collapse all files

3
apparmor.d/groups/_full/systemd
View file

@ -79,6 +79,7 @@ profile systemd flags=(attach_disconnected,mediate_deleted) {
umount,
pivot_root oldroot=@{run}/systemd/mount-rootfs/ @{run}/systemd/mount-rootfs/,
pivot_root oldroot=@{run}/systemd/unit-root/ @{run}/systemd/unit-root/,
change_profile,
@ -93,6 +94,7 @@ profile systemd flags=(attach_disconnected,mediate_deleted) {
# dbus: own bus=system name=org.freedesktop.systemd1
@{bin}/systemctl rix,
@{bin}/mount rix,
@{lib}/systemd/systemd-executor rix,
@{lib}/systemd/systemd rix, # FIXME: AppArmorProfile=systemd-user, does not work with DE
@ -100,7 +102,6 @@ profile systemd flags=(attach_disconnected,mediate_deleted) {
@{bin}/ldconfig rPx -> systemd.service,
@{bin}/mandb rPx -> systemd.service,
@{bin}/mount rPx -> systemd.service,
@{bin}/savelog rPx -> systemd.service,
@{coreutils_path} rPx -> systemd.service,
@{shells_path} rPx -> systemd.service,

47
apparmor.d/groups/_full/systemd-service Normal file
View file

@ -0,0 +1,47 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
# Profile for generic systemd unit services. Only used by service without profile.
# It does not specify an attachment path because it is intended to be used only
# via "Px -> systemd-service" exec transitions from the systemd profile.
abi <abi/3.0>,
include <tunables/global>
profile systemd-service @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/consoles>
capability sys_admin,
@{bin}/systemctl rix,
@{coreutils_path} rix,
@{shells_path} rmix,
@{bin}/ldconfig rix,
@{bin}/grub-editenv rPx,
@{bin}/ibus-daemon rPx,
@{lib}/ r,
/var/cache/ldconfig/{,**} rw,
/boot/grub/grubenv rw,
/boot/grub/ w,
/var/log/ r,
/var/log/dmesg rw,
/var/log/dmesg.* rwl -> /var/log/dmesg,
# snapd.system-shutdown.service
@{run}/initramfs/shutdown rw,
@{run}/initramfs/ rw,
@{PROC}/cmdline r,
@{PROC}/sys/kernel/osrelease r,
include if exists <usr/systemd-service.d>
include if exists <local/systemd-service>
}