felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): move kmod in subprofile.

Browse source
This commit is contained in:
Alexandre Pujol 2025-06-21 20:22:25 +02:00
parent e222816d32
commit f8250f7e0c
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
3 changed files with 22 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

18
apparmor.d/profiles-g-l/hw-probe
View file

@ -61,7 +61,7 @@ profile hw-probe @{exec_path} flags=(attach_disconnected) {
@{sbin}/iwconfig rCx -> netconfig,
@{bin}/journalctl rCx -> journalctl,
@{bin}/killall rCx -> killall,
@{bin}/kmod rix,
@{bin}/kmod rCx -> kmod,
@{bin}/lsb_release rPx -> lsb_release,
@{bin}/lsblk rPx,
@{bin}/lscpu rPx,
@ -98,19 +98,27 @@ profile hw-probe @{exec_path} flags=(attach_disconnected) {
@{sys}/devices/virtual/dmi/id/* r,
@{sys}/firmware/efi/efivars/ r,
@{sys}/firmware/efi/efivars/* r,
@{sys}/module/*/ r,
@{sys}/module/*/{coresize,refcnt} r,
@{sys}/module/*/holders/ r,
@{PROC}/bus/input/devices r,
@{PROC}/cmdline r,
@{PROC}/interrupts r,
@{PROC}/ioports r,
@{PROC}/modules r,
@{PROC}/scsi/scsi r,
/dev/{,**} r,
profile kmod {
include <abstractions/base>
include <abstractions/app/kmod>
capability sys_module,
@{sys}/module/compression r,
include if exists <local/hw-probe_kmod>
}
profile pacman flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/consoles>

13
apparmor.d/profiles-g-l/kernel
View file

@ -13,8 +13,6 @@ profile kernel @{exec_path} {
include <abstractions/consoles>
include <abstractions/nameservice-strict>
capability sys_module,
@{exec_path} mr,
@{sh_path} rix,
@ -24,7 +22,7 @@ profile kernel @{exec_path} {
@{bin}/chmod rix,
@{bin}/cut rix,
@{bin}/dirname rix,
@{bin}/kmod rix,
@{bin}/kmod rCx -> kmod,
@{bin}/mv rix,
@{bin}/rm rix,
@{bin}/rmdir rix,
@ -56,8 +54,6 @@ profile kernel @{exec_path} {
/etc/apt/apt.conf.d/ r,
/etc/apt/apt.conf.d/01autoremove-kernels{,.dpkg-new} rw,
/etc/modprobe.d/ r,
/etc/modprobe.d/*.conf r,
@{run}/reboot-required w,
@{run}/reboot-required.pkgs rw,
@ -65,6 +61,13 @@ profile kernel @{exec_path} {
@{PROC}/devices r,
@{PROC}/cmdline r,
profile kmod {
include <abstractions/base>
include <abstractions/app/kmod>
include if exists <local/kernel_kmod>
}
include if exists <local/kernel>
}

9
apparmor.d/profiles-g-l/kmod
View file

@ -10,7 +10,7 @@ include <tunables/global>
@{exec_path} = @{bin}/{kmod,lsmod,depmod,insmod,rmmod,modinfo,modprobe}
profile kmod @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/app/kmod>
include <abstractions/nameservice-strict>
capability dac_read_search,
@ -31,14 +31,10 @@ profile kmod @{exec_path} flags=(attach_disconnected) {
@{sbin}/sysctl rCx -> sysctl,
@{bin}/true rix,
@{lib}/modprobe.d/{,*.conf} r,
@{lib}/modules/*/modules.* rw,
@{run}/modprobe.d/{,*.conf} r,
/etc/depmod.d/{,**} r,
/etc/modprobe.d/{,*.conf} r,
/tmp/**/*.ko{,.zst} r,
/usr/src/*/*.ko r,
/var/lib/dkms/**/module/*.ko r,
@ -66,9 +62,6 @@ profile kmod @{exec_path} flags=(attach_disconnected) {
@{sys}/module/{,**} r,
@{PROC}/cmdline r,
@{PROC}/modules r,
/dev/tty@{int} rw,
deny @{user_share_dirs}/gvfs-metadata/* r,