felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): move kmod in subprofile.

Browse source
This commit is contained in:
Alexandre Pujol 2025-06-21 20:22:25 +02:00
parent e222816d32
commit f8250f7e0c
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
3 changed files with 22 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

18
apparmor.d/profiles-g-l/hw-probe
View file

@ -61,7 +61,7 @@ profile hw-probe @{exec_path} flags=(attach_disconnected) {
@{sbin}/iwconfig rCx -> netconfig, @{sbin}/iwconfig rCx -> netconfig,
@{bin}/journalctl rCx -> journalctl, @{bin}/journalctl rCx -> journalctl,
@{bin}/killall rCx -> killall, @{bin}/killall rCx -> killall,
@{bin}/kmod rix, @{bin}/kmod rCx -> kmod,
@{bin}/lsb_release rPx -> lsb_release, @{bin}/lsb_release rPx -> lsb_release,
@{bin}/lsblk rPx, @{bin}/lsblk rPx,
@{bin}/lscpu rPx, @{bin}/lscpu rPx,
@ -98,19 +98,27 @@ profile hw-probe @{exec_path} flags=(attach_disconnected) {
@{sys}/devices/virtual/dmi/id/* r, @{sys}/devices/virtual/dmi/id/* r,
@{sys}/firmware/efi/efivars/ r, @{sys}/firmware/efi/efivars/ r,
@{sys}/firmware/efi/efivars/* r, @{sys}/firmware/efi/efivars/* r,
@{sys}/module/*/ r,
@{sys}/module/*/{coresize,refcnt} r,
@{sys}/module/*/holders/ r,
@{PROC}/bus/input/devices r, @{PROC}/bus/input/devices r,
@{PROC}/cmdline r, @{PROC}/cmdline r,
@{PROC}/interrupts r, @{PROC}/interrupts r,
@{PROC}/ioports r, @{PROC}/ioports r,
@{PROC}/modules r,
@{PROC}/scsi/scsi r, @{PROC}/scsi/scsi r,
/dev/{,**} r, /dev/{,**} r,
profile kmod {
include <abstractions/base>
include <abstractions/app/kmod>
capability sys_module,
@{sys}/module/compression r,
include if exists <local/hw-probe_kmod>
}
profile pacman flags=(attach_disconnected) { profile pacman flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>

13
apparmor.d/profiles-g-l/kernel
View file

@ -13,8 +13,6 @@ profile kernel @{exec_path} {
include <abstractions/consoles> include <abstractions/consoles>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
capability sys_module,
@{exec_path} mr, @{exec_path} mr,
@{sh_path} rix, @{sh_path} rix,
@ -24,7 +22,7 @@ profile kernel @{exec_path} {
@{bin}/chmod rix, @{bin}/chmod rix,
@{bin}/cut rix, @{bin}/cut rix,
@{bin}/dirname rix, @{bin}/dirname rix,
@{bin}/kmod rix, @{bin}/kmod rCx -> kmod,
@{bin}/mv rix, @{bin}/mv rix,
@{bin}/rm rix, @{bin}/rm rix,
@{bin}/rmdir rix, @{bin}/rmdir rix,
@ -56,8 +54,6 @@ profile kernel @{exec_path} {
/etc/apt/apt.conf.d/ r, /etc/apt/apt.conf.d/ r,
/etc/apt/apt.conf.d/01autoremove-kernels{,.dpkg-new} rw, /etc/apt/apt.conf.d/01autoremove-kernels{,.dpkg-new} rw,
/etc/modprobe.d/ r,
/etc/modprobe.d/*.conf r,
@{run}/reboot-required w, @{run}/reboot-required w,
@{run}/reboot-required.pkgs rw, @{run}/reboot-required.pkgs rw,
@ -65,6 +61,13 @@ profile kernel @{exec_path} {
@{PROC}/devices r, @{PROC}/devices r,
@{PROC}/cmdline r, @{PROC}/cmdline r,
profile kmod {
include <abstractions/base>
include <abstractions/app/kmod>
include if exists <local/kernel_kmod>
}
include if exists <local/kernel> include if exists <local/kernel>
} }

9
apparmor.d/profiles-g-l/kmod
View file

@ -10,7 +10,7 @@ include <tunables/global>
@{exec_path} = @{bin}/{kmod,lsmod,depmod,insmod,rmmod,modinfo,modprobe} @{exec_path} = @{bin}/{kmod,lsmod,depmod,insmod,rmmod,modinfo,modprobe}
profile kmod @{exec_path} flags=(attach_disconnected) { profile kmod @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/app/kmod>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
capability dac_read_search, capability dac_read_search,
@ -31,14 +31,10 @@ profile kmod @{exec_path} flags=(attach_disconnected) {
@{sbin}/sysctl rCx -> sysctl, @{sbin}/sysctl rCx -> sysctl,
@{bin}/true rix, @{bin}/true rix,
@{lib}/modprobe.d/{,*.conf} r,
@{lib}/modules/*/modules.* rw, @{lib}/modules/*/modules.* rw,
@{run}/modprobe.d/{,*.conf} r, @{run}/modprobe.d/{,*.conf} r,
/etc/depmod.d/{,**} r,
/etc/modprobe.d/{,*.conf} r,
/tmp/**/*.ko{,.zst} r, /tmp/**/*.ko{,.zst} r,
/usr/src/*/*.ko r, /usr/src/*/*.ko r,
/var/lib/dkms/**/module/*.ko r, /var/lib/dkms/**/module/*.ko r,
@ -66,9 +62,6 @@ profile kmod @{exec_path} flags=(attach_disconnected) {
@{sys}/module/{,**} r, @{sys}/module/{,**} r,
@{PROC}/cmdline r,
@{PROC}/modules r,
/dev/tty@{int} rw, /dev/tty@{int} rw,
deny @{user_share_dirs}/gvfs-metadata/* r, deny @{user_share_dirs}/gvfs-metadata/* r,