felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profiles): first set of rules for Ubuntu Core support.

Browse source
This commit is contained in:
Alexandre Pujol 2023-02-19 18:22:18 +00:00
parent 1316e0ddde
commit ef292b585c
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
27 changed files with 351 additions and 92 deletions
Download patch file Download diff file Expand all files Collapse all files

37
apparmor.d/profiles-s-z/snap
View file

@ -12,10 +12,20 @@ profile snap @{exec_path} {
include <abstractions/consoles>
include <abstractions/dbus-session-strict>
include <abstractions/dbus-strict>
include <abstractions/disks-read>
include <abstractions/nameservice-strict>
capability sys_admin,
unix (send, receive) type=stream peer=(label=apt),
mount options=(ro, silent) -> /tmp/snapd-auto-import-mount-[0-9]*/,
dbus (send, receive) bus=session path=/org/freedesktop/
interface=org.freedesktop.systemd1.Manager
member={StartTransientUnit,JobRemoved}
peer=(name=:*, label=unconfined),
dbus send bus=session path=/org/freedesktop/portal/documents
interface=org.freedesktop.portal.Documents
member=GetMountPoint
@ -23,6 +33,8 @@ profile snap @{exec_path} {
@{exec_path} mrix,
/{usr/,}bin/mount rix,
/{usr/,}bin/systemctl rPx -> child-systemctl,
/snap/{,**} rw,
@ -34,27 +46,34 @@ profile snap @{exec_path} {
/var/lib/snapd/{,**} rwk,
/var/cache/snapd/commands.db rwk,
/var/cache/snapd/names r,
owner @{HOME}/snap/{,**} rw,
@{HOME}/snap/{,**} rw,
owner /tmp/snapd-auto-import-mount-[0-9]*/ rw,
owner @{run}/user/@{uid}/.mutter-Xwaylandauth.[0-9A-Z]* r,
owner @{run}/user/@{uid}/gdm/Xauthority r,
owner @{run}/user/@{uid}/snapd-session-agent.socket rw,
owner @{run}/user/@{uid}/systemd/notify rw,
@{run}/mount/utab r,
@{run}/snapd.socket rw,
@{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r,
@{sys}/kernel/security/apparmor/features/ r,
owner @{PROC}/@{pids}/mountinfo r,
@{PROC}/@{pids}/cgroup r,
@{PROC}/cgroups r,
@{PROC}/cmdline r,
@{PROC}/sys/kernel/random/boot_id r,
@{PROC}/sys/kernel/random/uuid r,
@{PROC}/sys/kernel/seccomp/actions_avail r,
@{PROC}/version r,
@{PROC}/@{pids}/cgroup r,
@{PROC}/@{pids}/mountinfo r,
@{PROC}/cgroups r,
@{PROC}/cmdline r,
@{PROC}/sys/kernel/random/boot_id r,
@{PROC}/sys/kernel/random/uuid r,
@{PROC}/sys/kernel/seccomp/actions_avail r,
@{PROC}/version r,
/dev/tty[0-9]* rw,
/dev/ttyS[0-9]* rw,
deny @{user_share_dirs}/gvfs-metadata/* r,