felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): use @{sbin} for all program inside /usr/sbin.

Browse source
This commit is contained in:
Alexandre Pujol 2025-04-28 21:27:57 +02:00
parent b8f2f38c72
commit fd17a77b17
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
270 changed files with 475 additions and 475 deletions
Download patch file Download diff file Expand all files Collapse all files

4
apparmor.d/groups/apparmor/aa-enforce
View file

@ -6,7 +6,7 @@ abi <abi/4.0>,
include <tunables/global>
@{exec_path} = @{bin}/aa-enforce @{bin}/aa-complain @{bin}/aa-audit @{bin}/aa-disable
@{exec_path} = @{sbin}/aa-enforce @{sbin}/aa-complain @{sbin}/aa-audit @{sbin}/aa-disable
profile aa-enforce @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
@ -17,7 +17,7 @@ profile aa-enforce @{exec_path} {
@{exec_path} mr,
@{bin}/ r,
@{bin}/apparmor_parser rPx,
@{sbin}/apparmor_parser rPx,
/usr/share/terminfo/** r,

2
apparmor.d/groups/apparmor/aa-notify
View file

@ -89,7 +89,7 @@ profile aa-notify @{exec_path} {
ptrace read peer=aa-notify,
@{bin}/apparmor_parser Px,
@{sbin}/apparmor_parser Px,
@{lib}/@{python_name}/site-packages/apparmor/update_profile.py ix,
/usr/share/apparmor/** r,

2
apparmor.d/groups/apparmor/aa-status
View file

@ -6,7 +6,7 @@ abi <abi/4.0>,
include <tunables/global>
@{exec_path} = @{bin}/aa-status @{bin}/apparmor_status
@{exec_path} = @{sbin}/aa-status @{sbin}/apparmor_status
profile aa-status @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>

2
apparmor.d/groups/apparmor/aa-teardown
View file

@ -6,7 +6,7 @@ abi <abi/4.0>,
include <tunables/global>
@{exec_path} = @{bin}/aa-teardown
@{exec_path} = @{sbin}/aa-teardown
profile aa-teardown @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>

2
apparmor.d/groups/apparmor/aa-unconfined
View file

@ -6,7 +6,7 @@ abi <abi/4.0>,
include <tunables/global>
@{exec_path} = @{bin}/aa-unconfined
@{exec_path} = @{sbin}/aa-unconfined
profile aa-unconfined @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/consoles>

6
apparmor.d/groups/apparmor/apparmor.systemd
View file

@ -19,14 +19,14 @@ profile apparmor.systemd @{exec_path} {
@{sh_path} rix,
@{bin}/{,e}grep rix,
@{bin}/aa-status rPx,
@{bin}/apparmor_parser rPx,
@{sbin}/aa-status rPx,
@{sbin}/apparmor_parser rPx,
@{bin}/getconf rix,
@{bin}/ls rix,
@{bin}/sed rix,
@{bin}/cat rix,
@{bin}/sort rix,
@{bin}/sysctl rix,
@{sbin}/sysctl rix,
@{bin}/systemd-detect-virt rPx,
@{bin}/xargs rix,

2
apparmor.d/groups/apparmor/apparmor_parser
View file

@ -8,7 +8,7 @@ include <tunables/global>
@{lib_dirs} = @{lib}/ /snap/snapd/@{int}@{lib}
@{exec_path} = @{bin}/apparmor_parser @{lib_dirs}/snapd/apparmor_parser
@{exec_path} = @{sbin}/apparmor_parser @{lib_dirs}/snapd/apparmor_parser
profile apparmor_parser @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/consoles>