felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): finalize upgrade process.

Browse source
This commit is contained in:
Alexandre Pujol 2025-05-26 00:18:01 +02:00
parent a8ab6da6f3
commit e83a9a60dc
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
7 changed files with 17 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

1
apparmor.d/groups/apt/dpkg-preconfigure
View file

@ -30,7 +30,6 @@ profile dpkg-preconfigure @{exec_path} {
@{bin}/head ix, @{bin}/head ix,
@{bin}/locale ix, @{bin}/locale ix,
@{bin}/readlink ix, @{bin}/readlink ix,
@{bin}/readlink ix,
@{bin}/realpath ix, @{bin}/realpath ix,
@{bin}/sed ix, @{bin}/sed ix,
@{bin}/sort ix, @{bin}/sort ix,

16
apparmor.d/groups/apt/dpkg-scripts
View file

@ -47,11 +47,11 @@ profile dpkg-scripts @{exec_path} {
@{sbin}/update-rc.d Cx -> rc, @{sbin}/update-rc.d Cx -> rc,
# Maintainer scripts can legitimately start/restart anything # Maintainer scripts can legitimately start/restart anything
@{bin}/** Px, @{bin}/** PUx,
@{sbin}/** Px, @{sbin}/** PUx,
@{lib}/** Px, @{lib}/** PUx,
/usr/share/** Px, /usr/share/** PUx,
/etc/init.d/* Px, /etc/init.d/* PUx,
# Maintainer's scripts can update a lot of files # Maintainer's scripts can update a lot of files
/ r, / r,
@ -76,9 +76,9 @@ profile dpkg-scripts @{exec_path} {
include <abstractions/bus-system> include <abstractions/bus-system>
dbus send bus=system path=/ dbus send bus=system path=/
interface=org.freedesktop.DBus interface=org.freedesktop.DBus
member=ReloadConfig member=ReloadConfig
peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"), peer=(name=org.freedesktop.DBus, label="@{p_dbus_system}"),
include if exists <local/dpkg-scripts_bus> include if exists <local/dpkg-scripts_bus>
} }

2
apparmor.d/groups/browsers/firefox
View file

@ -39,7 +39,7 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
@{bin}/kreadconfig{,5} rPx, @{bin}/kreadconfig{,5} rPx,
@{bin}/plasma-browser-integration-host rPx, @{bin}/plasma-browser-integration-host rPx,
@{bin}/speech-dispatcher rPx, @{bin}/speech-dispatcher rPx,
@{sbin}/update-mime-database rPx, @{bin}/update-mime-database rPx,
@{lib}/gvfsd-metadata rPx, @{lib}/gvfsd-metadata rPx,
@{lib}/mozilla/kmozillahelper rPUx, @{lib}/mozilla/kmozillahelper rPUx,
@{open_path} rPx -> child-open, @{open_path} rPx -> child-open,

5
apparmor.d/groups/snap/snap
View file

@ -85,8 +85,9 @@ profile snap @{exec_path} flags=(attach_disconnected) {
@{sys}/fs/cgroup/cgroup.controllers r, @{sys}/fs/cgroup/cgroup.controllers r,
@{sys}/kernel/security/apparmor/features/{,**} r, @{sys}/kernel/security/apparmor/features/{,**} r,
@{PROC}/@{pids}/cgroup r, @{PROC}/@{pid}/cgroup r,
@{PROC}/@{pids}/mountinfo r, @{PROC}/@{pid}/maps r,
@{PROC}/@{pid}/mountinfo r,
@{PROC}/cgroups r, @{PROC}/cgroups r,
@{PROC}/cmdline r, @{PROC}/cmdline r,
@{PROC}/sys/kernel/random/uuid r, @{PROC}/sys/kernel/random/uuid r,

2
apparmor.d/groups/snap/snapd
View file

@ -208,6 +208,8 @@ profile snapd @{exec_path} {
network netlink raw, network netlink raw,
signal receive set=kill peer=snapd,
@{bin}/journalctl mr, @{bin}/journalctl mr,
/etc/machine-id r, /etc/machine-id r,

2
apparmor.d/profiles-s-z/which
View file

@ -7,7 +7,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/which{.debianutils,} @{exec_path} = @{bin}/which{,.debianutils}
profile which @{exec_path} flags=(attach_disconnected) { profile which @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>

6
apparmor.d/profiles-s-z/whiptail
View file

@ -8,7 +8,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/whiptail @{exec_path} = @{bin}/whiptail
profile whiptail @{exec_path} flags=(complain) { profile whiptail @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>
@ -16,9 +16,7 @@ profile whiptail @{exec_path} flags=(complain) {
@{exec_path} mr, @{exec_path} mr,
/etc/newt/palette.* r, /usr/share/terminfo/** r,
owner @{tmp}/gpm* w,
include if exists <local/whiptail> include if exists <local/whiptail>
} }