felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(profiles): ensure entry points for snap work.

Browse source
This commit is contained in:
Alexandre Pujol 2023-09-05 13:59:37 +01:00
parent 2242fc3f47
commit e169ea5ccf
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
6 changed files with 36 additions and 23 deletions
Download patch file Download diff file Expand all files Collapse all files

25
apparmor.d/profiles-s-z/snapd
View file

@ -6,7 +6,10 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/snapd/snapd /snap/snapd/@{int}@{lib}/snapd/snapd
@{bin_dirs} = @{bin}/ /snap/snapd/@{int}@{bin}/
@{lib_dirs} = @{lib}/ /snap/snapd/@{int}@{lib}/
@{exec_path} = @{lib_dirs}/snapd/snapd
profile snapd @{exec_path} {
include <abstractions/base>
include <abstractions/authentication>
@ -58,7 +61,7 @@ profile snapd @{exec_path} {
member=CheckAuthorization
peer=(name=org.freedesktop.PolicyKit1),
@{exec_path} mr,
@{exec_path} mrix,
@{bin}/adduser rPx,
@{bin}/cloud-init rPUx, # TODO: rPx ? limited to ubtuntu core, otherwise out of scope
@ -84,15 +87,15 @@ profile snapd @{exec_path} {
@{bin}/unsquashfs rix,
@{bin}/update-desktop-database rPx,
/{snap/snapd/@{int}/,}{usr/,}bin/fc-cache-* mr,
/{snap/snapd/@{int}/,}{usr/,}bin/snap rPx,
/{snap/snapd/@{int}/,}{usr/,}bin/xdelta3 rix, # TODO: rPx ?
/{snap/snapd/@{int}/,}{usr/,}lib/@{multiarch}/** mr,
/{snap/snapd/@{int}/,}{usr/,}lib/@{multiarch}/ld-*.so rix,
/{snap/snapd/@{int}/,}{usr/,}lib/snapd/snap-discard-ns rPx,
/{snap/snapd/@{int}/,}{usr/,}lib/snapd/snap-seccomp rPx,
/{snap/snapd/@{int}/,}{usr/,}lib/snapd/snap-update-ns rPx,
/{snap/snapd/@{int}/,}{usr/,}lib/snapd/snapd rix,
@{bin_dirs}/fc-cache-* mr,
@{bin_dirs}/snap rPx,
@{bin_dirs}/xdelta3 rix,
@{lib_dirs}/@{multiarch}/** mr,
@{lib_dirs}/@{multiarch}/ld-*.so rix,
@{lib_dirs}/snapd/apparmor_parser rPx -> apparmor_parser,
@{lib_dirs}/snapd/snap-discard-ns rPx,
@{lib_dirs}/snapd/snap-seccomp rPx,
@{lib_dirs}/snapd/snap-update-ns rPx,
/usr/share/bash-completion/{,**} r,
/usr/share/dbus-1/{system,session}.d/{,snapd*} r,