felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): use @{sbin} for all program inside /usr/sbin.

Browse source
This commit is contained in:
Alexandre Pujol 2025-04-28 21:27:57 +02:00
parent b8f2f38c72
commit fd17a77b17
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
270 changed files with 475 additions and 475 deletions
Download patch file Download diff file Expand all files Collapse all files

12
apparmor.d/abstractions/app/kmod
View file

@ -7,13 +7,13 @@
include <abstractions/consoles> include <abstractions/consoles>
@{bin}/depmod mr, @{sbin}/depmod mr,
@{bin}/insmod mr, @{sbin}/insmod mr,
@{bin}/kmod mr, @{bin}/kmod mr,
@{bin}/lsmod mr, @{sbin}/lsmod mr,
@{bin}/modinfo mr, @{sbin}/modinfo mr,
@{bin}/modprobe mr, @{sbin}/modprobe mr,
@{bin}/rmmod mr, @{sbin}/rmmod mr,
@{lib}/modprobe.d/ r, @{lib}/modprobe.d/ r,
@{lib}/modprobe.d/*.conf r, @{lib}/modprobe.d/*.conf r,

2
apparmor.d/abstractions/authentication.d/complete
View file

@ -6,7 +6,7 @@
@{lib}/pam-tmpdir/pam-tmpdir-helper rPx, @{lib}/pam-tmpdir/pam-tmpdir-helper rPx,
#aa:only abi3 #aa:only abi3
@{bin}/unix_chkpwd rPx, @{sbin}/unix_chkpwd rPx,
#aa:only whonix #aa:only whonix
@{lib}/security-misc/pam-abort-on-locked-password rPx, @{lib}/security-misc/pam-abort-on-locked-password rPx,

2
apparmor.d/groups/_full/systemd
View file

@ -173,7 +173,7 @@ profile systemd flags=(attach_disconnected,mediate_deleted) {
# Shell based systemd unit services # Shell based systemd unit services
# TODO: create unit profile for all of them # TODO: create unit profile for all of them
@{bin}/ldconfig Px -> systemd-service, @{sbin}/ldconfig Px -> systemd-service,
@{bin}/mandb Px -> systemd-service, @{bin}/mandb Px -> systemd-service,
@{bin}/savelog Px -> systemd-service, @{bin}/savelog Px -> systemd-service,
@{coreutils_path} Px -> systemd-service, @{coreutils_path} Px -> systemd-service,

6
apparmor.d/groups/_full/systemd-service
View file

@ -21,7 +21,7 @@ profile systemd-service flags=(attach_disconnected) {
capability chown, capability chown,
capability fsetid, capability fsetid,
@{bin}/ldconfig rix, @{sbin}/ldconfig rix,
@{bin}/savelog rix, @{bin}/savelog rix,
@{bin}/systemctl rix, @{bin}/systemctl rix,
@{bin}/gzip rix, @{bin}/gzip rix,
@ -32,8 +32,8 @@ profile systemd-service flags=(attach_disconnected) {
@{bin}/ifup rPx, @{bin}/ifup rPx,
# shadow.service # shadow.service
@{bin}/pwck rPx, @{sbin}/pwck rPx,
@{bin}/grpck rPx, @{sbin}/grpck rPx,
@{bin}/grub-editenv rPx, @{bin}/grub-editenv rPx,
@{bin}/ibus-daemon rPx, @{bin}/ibus-daemon rPx,

4
apparmor.d/groups/apparmor/aa-enforce
View file

@ -6,7 +6,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/aa-enforce @{bin}/aa-complain @{bin}/aa-audit @{bin}/aa-disable @{exec_path} = @{sbin}/aa-enforce @{sbin}/aa-complain @{sbin}/aa-audit @{sbin}/aa-disable
profile aa-enforce @{exec_path} { profile aa-enforce @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>
@ -17,7 +17,7 @@ profile aa-enforce @{exec_path} {
@{exec_path} mr, @{exec_path} mr,
@{bin}/ r, @{bin}/ r,
@{bin}/apparmor_parser rPx, @{sbin}/apparmor_parser rPx,
/usr/share/terminfo/** r, /usr/share/terminfo/** r,

2
apparmor.d/groups/apparmor/aa-notify
View file

@ -89,7 +89,7 @@ profile aa-notify @{exec_path} {
ptrace read peer=aa-notify, ptrace read peer=aa-notify,
@{bin}/apparmor_parser Px, @{sbin}/apparmor_parser Px,
@{lib}/@{python_name}/site-packages/apparmor/update_profile.py ix, @{lib}/@{python_name}/site-packages/apparmor/update_profile.py ix,
/usr/share/apparmor/** r, /usr/share/apparmor/** r,

2
apparmor.d/groups/apparmor/aa-status
View file

@ -6,7 +6,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/aa-status @{bin}/apparmor_status @{exec_path} = @{sbin}/aa-status @{sbin}/apparmor_status
profile aa-status @{exec_path} { profile aa-status @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>

2
apparmor.d/groups/apparmor/aa-teardown
View file

@ -6,7 +6,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/aa-teardown @{exec_path} = @{sbin}/aa-teardown
profile aa-teardown @{exec_path} { profile aa-teardown @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>

2
apparmor.d/groups/apparmor/aa-unconfined
View file

@ -6,7 +6,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/aa-unconfined @{exec_path} = @{sbin}/aa-unconfined
profile aa-unconfined @{exec_path} flags=(attach_disconnected) { profile aa-unconfined @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>

6
apparmor.d/groups/apparmor/apparmor.systemd
View file

@ -19,14 +19,14 @@ profile apparmor.systemd @{exec_path} {
@{sh_path} rix, @{sh_path} rix,
@{bin}/{,e}grep rix, @{bin}/{,e}grep rix,
@{bin}/aa-status rPx, @{sbin}/aa-status rPx,
@{bin}/apparmor_parser rPx, @{sbin}/apparmor_parser rPx,
@{bin}/getconf rix, @{bin}/getconf rix,
@{bin}/ls rix, @{bin}/ls rix,
@{bin}/sed rix, @{bin}/sed rix,
@{bin}/cat rix, @{bin}/cat rix,
@{bin}/sort rix, @{bin}/sort rix,
@{bin}/sysctl rix, @{sbin}/sysctl rix,
@{bin}/systemd-detect-virt rPx, @{bin}/systemd-detect-virt rPx,
@{bin}/xargs rix, @{bin}/xargs rix,

2
apparmor.d/groups/apparmor/apparmor_parser
View file

@ -8,7 +8,7 @@ include <tunables/global>
@{lib_dirs} = @{lib}/ /snap/snapd/@{int}@{lib} @{lib_dirs} = @{lib}/ /snap/snapd/@{int}@{lib}
@{exec_path} = @{bin}/apparmor_parser @{lib_dirs}/snapd/apparmor_parser @{exec_path} = @{sbin}/apparmor_parser @{lib_dirs}/snapd/apparmor_parser
profile apparmor_parser @{exec_path} flags=(attach_disconnected) { profile apparmor_parser @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>

4
apparmor.d/groups/apt/apt
View file

@ -7,7 +7,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/apt @{bin}/apt-get @{bin}/aptd @{exec_path} = @{bin}/apt @{bin}/apt-get @{sbin}/aptd
profile apt @{exec_path} flags=(attach_disconnected) { profile apt @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/common/apt> include <abstractions/common/apt>
@ -80,7 +80,7 @@ profile apt @{exec_path} flags=(attach_disconnected) {
@{bin}/df rPx, @{bin}/df rPx,
@{bin}/dmesg rPx, @{bin}/dmesg rPx,
@{bin}/dpkg rPx, @{bin}/dpkg rPx,
@{bin}/dpkg-preconfigure rPx, @{sbin}/dpkg-preconfigure rPx,
@{bin}/dpkg-source rcx -> dpkg-source, @{bin}/dpkg-source rcx -> dpkg-source,
@{bin}/etckeeper rPx, @{bin}/etckeeper rPx,
@{bin}/localepurge rPx, @{bin}/localepurge rPx,

2
apparmor.d/groups/apt/aptitude
View file

@ -75,7 +75,7 @@ profile aptitude @{exec_path} flags=(complain) {
@{bin}/apt-listbugs rPx, @{bin}/apt-listbugs rPx,
@{bin}/apt-listchanges rPx, @{bin}/apt-listchanges rPx,
@{bin}/apt-show-versions rPx, @{bin}/apt-show-versions rPx,
@{bin}/dpkg-preconfigure rPx, @{sbin}/dpkg-preconfigure rPx,
@{bin}/debtags rPx, @{bin}/debtags rPx,
@{bin}/localepurge rPx, @{bin}/localepurge rPx,
@{bin}/appstreamcli rPx, @{bin}/appstreamcli rPx,

2
apparmor.d/groups/apt/dpkg-preconfigure
View file

@ -7,7 +7,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/dpkg-preconfigure @{exec_path} = @{sbin}/dpkg-preconfigure
profile dpkg-preconfigure @{exec_path} { profile dpkg-preconfigure @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>

2
apparmor.d/groups/apt/querybts
View file

@ -31,7 +31,7 @@ profile querybts @{exec_path} {
@{bin}/ r, @{bin}/ r,
@{sh_path} rix, @{sh_path} rix,
@{bin}/stty rix, @{bin}/stty rix,
@{bin}/ldconfig rix, @{sbin}/ldconfig rix,
@{open_path} rPx -> child-open-browsers, @{open_path} rPx -> child-open-browsers,

2
apparmor.d/groups/apt/reportbug
View file

@ -30,7 +30,7 @@ profile reportbug @{exec_path} {
@{bin}/ r, @{bin}/ r,
@{python_path} r, @{python_path} r,
@{bin}/ldconfig rix, @{sbin}/ldconfig rix,
@{bin}/selinuxenabled rix, @{bin}/selinuxenabled rix,
@{sh_path} rix, @{sh_path} rix,
@{bin}/aa-enabled rix, @{bin}/aa-enabled rix,

2
apparmor.d/groups/apt/synaptic
View file

@ -45,7 +45,7 @@ profile synaptic @{exec_path} {
@{bin}/deborphan rPx, @{bin}/deborphan rPx,
@{bin}/debtags rPx, @{bin}/debtags rPx,
@{bin}/dpkg rPx, @{bin}/dpkg rPx,
@{bin}/dpkg-preconfigure rPx, @{sbin}/dpkg-preconfigure rPx,
@{bin}/localepurge rPx, @{bin}/localepurge rPx,
@{bin}/lsb_release rPx -> lsb_release, @{bin}/lsb_release rPx -> lsb_release,
@{bin}/pkexec rCx -> pkexec, @{bin}/pkexec rCx -> pkexec,

4
apparmor.d/groups/apt/unattended-upgrade
View file

@ -51,10 +51,10 @@ profile unattended-upgrade @{exec_path} flags=(attach_disconnected) {
@{bin}/apt-listchanges rPx, @{bin}/apt-listchanges rPx,
@{bin}/dpkg rPx, @{bin}/dpkg rPx,
@{bin}/dpkg-divert rPx, @{bin}/dpkg-divert rPx,
@{bin}/dpkg-preconfigure rPx, @{sbin}/dpkg-preconfigure rPx,
@{bin}/etckeeper rPx, @{bin}/etckeeper rPx,
@{bin}/lsb_release rPx -> lsb_release, @{bin}/lsb_release rPx -> lsb_release,
@{bin}/on_ac_power rPx, @{sbin}/on_ac_power rPx,
@{bin}/sendmail rPUx, @{bin}/sendmail rPUx,
@{lib}/apt/methods/http{,s} rPx, @{lib}/apt/methods/http{,s} rPx,
@{lib}/needrestart/apt-pinvoke rPx, @{lib}/needrestart/apt-pinvoke rPx,

6
apparmor.d/groups/bluetooth/blueman-mechanism
View file

@ -36,9 +36,9 @@ profile blueman-mechanism @{exec_path} flags=(attach_disconnected) {
/dev/rfkill rw, /dev/rfkill rw,
# For network AP # For network AP
#@{bin}/ip rix, #@{sbin}/ip rix,
#@{bin}/xtables-nft-multi rix, #@{sbin}/xtables-nft-multi rix,
#@{bin}/dnsmasq rPx, #@{sbin}/dnsmasq rPx,
#@{bin}/dhclient rPx, #@{bin}/dhclient rPx,
# @{PROC}/sys/net/ipv4/ip_forward w, # @{PROC}/sys/net/ipv4/ip_forward w,
# @{PROC}/sys/net/ipv4/conf/ r, # @{PROC}/sys/net/ipv4/conf/ r,

2
apparmor.d/groups/browsers/firefox
View file

@ -39,7 +39,7 @@ profile firefox @{exec_path} flags=(attach_disconnected) {
@{bin}/kreadconfig{,5} rPx, @{bin}/kreadconfig{,5} rPx,
@{bin}/plasma-browser-integration-host rPx, @{bin}/plasma-browser-integration-host rPx,
@{bin}/speech-dispatcher rPx, @{bin}/speech-dispatcher rPx,
@{bin}/update-mime-database rPx, @{sbin}/update-mime-database rPx,
@{lib}/gvfsd-metadata rPx, @{lib}/gvfsd-metadata rPx,
@{lib}/mozilla/kmozillahelper rPUx, @{lib}/mozilla/kmozillahelper rPUx,
@{open_path} rPx -> child-open, @{open_path} rPx -> child-open,

2
apparmor.d/groups/cron/anacron
View file

@ -6,7 +6,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/anacron @{exec_path} = @{sbin}/anacron
profile anacron @{exec_path} { profile anacron @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>

2
apparmor.d/groups/cron/cron
View file

@ -7,7 +7,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/cron @{exec_path} = @{sbin}/cron
profile cron @{exec_path} flags=(attach_disconnected) { profile cron @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/app-launcher-root> include <abstractions/app-launcher-root>

2
apparmor.d/groups/cron/cron-anacron
View file

@ -12,7 +12,7 @@ profile cron-anacron @{exec_path} {
@{exec_path} r, @{exec_path} r,
@{bin}/anacron rPx, @{sbin}/anacron rPx,
@{sh_path} rix, @{sh_path} rix,
@{bin}/cat rix, @{bin}/cat rix,
@{bin}/date rix, @{bin}/date rix,

2
apparmor.d/groups/cron/cron-apt
View file

@ -7,7 +7,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/cron-apt @{exec_path} = @{sbin}/cron-apt
profile cron-apt @{exec_path} { profile cron-apt @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>

2
apparmor.d/groups/cron/cron-apt-compat
View file

@ -14,7 +14,7 @@ profile cron-apt-compat @{exec_path} {
@{exec_path} r, @{exec_path} r,
@{sh_path} rix, @{sh_path} rix,
@{bin}/on_ac_power rPx, @{sbin}/on_ac_power rPx,
@{bin}/apt-config rPx, @{bin}/apt-config rPx,
@{lib}/apt/apt.systemd.daily rPx, @{lib}/apt/apt.systemd.daily rPx,

2
apparmor.d/groups/cron/cron-apt-xapian-index
View file

@ -22,7 +22,7 @@ profile cron-apt-xapian-index @{exec_path} {
@{bin}/ r, @{bin}/ r,
@{bin}/update-apt-xapian-index rPx, @{bin}/update-apt-xapian-index rPx,
@{bin}/on_ac_power rPx, @{sbin}/on_ac_power rPx,
# For shell pwd # For shell pwd
/ r, / r,

2
apparmor.d/groups/cron/cron-cracklib
View file

@ -15,7 +15,7 @@ profile cron-cracklib @{exec_path} {
@{sh_path} rix, @{sh_path} rix,
@{bin}/logger rix, @{bin}/logger rix,
@{bin}/update-cracklib rPx, @{sbin}/update-cracklib rPx,
/etc/cracklib/cracklib.conf r, /etc/cracklib/cracklib.conf r,

4
apparmor.d/groups/cron/cron-exim4-base
View file

@ -39,8 +39,8 @@ profile cron-exim4-base @{exec_path} {
@{bin}/exim4 rPx, @{bin}/exim4 rPx,
@{bin}/exim_tidydb rix, @{bin}/exim_tidydb rix,
@{bin}/start-stop-daemon rix, @{sbin}/start-stop-daemon rix,
@{bin}/runuser rix, @{sbin}/runuser rix,
/etc/default/exim4 r, /etc/default/exim4 r,

2
apparmor.d/groups/cron/cron-ipset-autoban-save
View file

@ -15,7 +15,7 @@ profile cron-ipset-autoban-save @{exec_path} {
@{exec_path} r, @{exec_path} r,
@{sh_path} rix, @{sh_path} rix,
@{bin}/ipset rix, @{sbin}/ipset rix,
/etc/peerblock/autoban rw, /etc/peerblock/autoban rw,

2
apparmor.d/groups/cron/cron-logrotate
View file

@ -14,7 +14,7 @@ profile cron-logrotate @{exec_path} {
@{exec_path} r, @{exec_path} r,
@{sh_path} rix, @{sh_path} rix,
@{bin}/logrotate rPx, @{sbin}/logrotate rPx,
@{bin}/logger rix, @{bin}/logger rix,

2
apparmor.d/groups/cron/cron-man-db
View file

@ -20,7 +20,7 @@ profile cron-man-db @{exec_path} {
@{sh_path} rix, @{sh_path} rix,
@{bin}/{,e}grep rix, @{bin}/{,e}grep rix,
@{bin}/start-stop-daemon rix, @{sbin}/start-stop-daemon rix,
@{bin}/xargs rix, @{bin}/xargs rix,
@{bin}/find rix, @{bin}/find rix,

2
apparmor.d/groups/cron/cron-mlocate
View file

@ -23,7 +23,7 @@ profile cron-mlocate @{exec_path} {
@{bin}/nice rix, @{bin}/nice rix,
@{bin}/updatedb.mlocate rPx, @{bin}/updatedb.mlocate rPx,
@{bin}/on_ac_power rPx, @{sbin}/on_ac_power rPx,
@{run}/mlocate.daily.lock rwk, @{run}/mlocate.daily.lock rwk,

2
apparmor.d/groups/cron/cron-plocate
View file

@ -23,7 +23,7 @@ profile cron-plocate @{exec_path} {
@{bin}/nice rix, @{bin}/nice rix,
@{bin}/updatedb.plocate rPx, @{bin}/updatedb.plocate rPx,
@{bin}/on_ac_power rPx, @{sbin}/on_ac_power rPx,
@{run}/plocate.daily.lock rwk, @{run}/plocate.daily.lock rwk,

6
apparmor.d/groups/cron/cron-popularity-contest
View file

@ -29,11 +29,11 @@ profile cron-popularity-contest @{exec_path} {
# To send reports via TOR # To send reports via TOR
@{bin}/torify rix, @{bin}/torify rix,
@{bin}/torsocks rix, @{bin}/torsocks rix,
@{bin}/getcap rix, @{sbin}/getcap rix,
/usr/share/popularity-contest/popcon-upload rCx -> popcon-upload, /usr/share/popularity-contest/popcon-upload rCx -> popcon-upload,
@{bin}/gpg{,2} rCx -> gpg, @{bin}/gpg{,2} rCx -> gpg,
@{bin}/runuser rCx -> runuser, @{sbin}/runuser rCx -> runuser,
@{bin}/savelog rCx -> savelog, @{bin}/savelog rCx -> savelog,
/usr/share/popularity-contest/ r, /usr/share/popularity-contest/ r,
@ -93,7 +93,7 @@ profile cron-popularity-contest @{exec_path} {
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/authentication> include <abstractions/authentication>
@{bin}/runuser mr, @{sbin}/runuser mr,
@{sh_path} rix, @{sh_path} rix,
@{bin}/popularity-contest rPx, @{bin}/popularity-contest rPx,

2
apparmor.d/groups/cron/crontab
View file

@ -7,7 +7,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/crontab @{exec_path} = @{sbin}/crontab
profile crontab @{exec_path} { profile crontab @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/authentication> include <abstractions/authentication>

2
apparmor.d/groups/cups/cups-browsed
View file

@ -6,7 +6,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/cups-browsed @{exec_path} = @{sbin}/cups-browsed
profile cups-browsed @{exec_path} { profile cups-browsed @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/bus-system> include <abstractions/bus-system>

4
apparmor.d/groups/cups/cupsd
View file

@ -6,7 +6,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/cupsd @{exec_path} = @{sbin}/cupsd
profile cupsd @{exec_path} flags=(attach_disconnected) { profile cupsd @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/authentication> include <abstractions/authentication>
@ -54,7 +54,7 @@ profile cupsd @{exec_path} flags=(attach_disconnected) {
@{bin}/gs rix, @{bin}/gs rix,
@{bin}/gsc rix, @{bin}/gsc rix,
@{bin}/hostname rix, @{bin}/hostname rix,
@{bin}/ippfind rix, @{sbin}/ippfind rix,
@{bin}/mktemp rix, @{bin}/mktemp rix,
@{bin}/printenv rix, @{bin}/printenv rix,
@{python_path} rix, @{python_path} rix,

2
apparmor.d/groups/filesystem/fsck.btrfs
View file

@ -7,7 +7,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/fsck.btrfs @{exec_path} = @{sbin}/fsck.btrfs
profile fsck.btrfs @{exec_path} { profile fsck.btrfs @{exec_path} {
include <abstractions/base> include <abstractions/base>

2
apparmor.d/groups/filesystem/fsck.fat
View file

@ -7,7 +7,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/fsck.fat @{bin}/fsck.msdos @{bin}/fsck.vfat @{bin}/dosfsck @{exec_path} = @{sbin}/fsck.fat @{sbin}/fsck.msdos @{sbin}/fsck.vfat @{sbin}/dosfsck
profile fsck.fat @{exec_path} { profile fsck.fat @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/disks-write> include <abstractions/disks-write>

2
apparmor.d/groups/filesystem/lvm
View file

@ -6,7 +6,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/lvm @{exec_path} = @{sbin}/lvm
profile lvm @{exec_path} flags=(attach_disconnected) { profile lvm @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/bus-system> include <abstractions/bus-system>

2
apparmor.d/groups/filesystem/lvmconfig
View file

@ -6,7 +6,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/lvmconfig @{exec_path} = @{sbin}/lvmconfig
profile lvmconfig @{exec_path} { profile lvmconfig @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>

2
apparmor.d/groups/filesystem/lvmdump
View file

@ -6,7 +6,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/lvmdump @{exec_path} = @{sbin}/lvmdump
profile lvmdump @{exec_path} { profile lvmdump @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>

2
apparmor.d/groups/filesystem/lvmpolld
View file

@ -6,7 +6,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/lvmpolld @{exec_path} = @{sbin}/lvmpolld
profile lvmpolld @{exec_path} { profile lvmpolld @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>

4
apparmor.d/groups/filesystem/mke2fs
View file

@ -7,7 +7,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/mke2fs @{bin}/mkfs.ext2 @{bin}/mkfs.ext3 @{bin}/mkfs.ext4 @{exec_path} = @{sbin}/mke2fs @{sbin}/mkfs.ext2 @{sbin}/mkfs.ext3 @{sbin}/mkfs.ext4
profile mke2fs @{exec_path} { profile mke2fs @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/disks-write> include <abstractions/disks-write>
@ -19,7 +19,7 @@ profile mke2fs @{exec_path} {
# To check for badblocks # To check for badblocks
@{sh_path} rix, @{sh_path} rix,
@{bin}/badblocks rPx, @{sbin}/badblocks rPx,
/usr/share/file/misc/magic.mgc r, /usr/share/file/misc/magic.mgc r,

2
apparmor.d/groups/filesystem/mkfs-btrfs
View file

@ -7,7 +7,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/mkfs.btrfs @{exec_path} = @{sbin}/mkfs.btrfs
profile mkfs-btrfs @{exec_path} { profile mkfs-btrfs @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/disks-write> include <abstractions/disks-write>

2
apparmor.d/groups/filesystem/mkswap
View file

@ -7,7 +7,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/mkswap @{exec_path} = @{sbin}/mkswap
profile mkswap @{exec_path} { profile mkswap @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/disks-write> include <abstractions/disks-write>

2
apparmor.d/groups/filesystem/mount-cifs
View file

@ -7,7 +7,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/mount.cifs @{exec_path} = @{sbin}/mount.cifs
profile mount-cifs @{exec_path} flags=(complain) { profile mount-cifs @{exec_path} flags=(complain) {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>

2
apparmor.d/groups/filesystem/ntfsclone
View file

@ -7,7 +7,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/ntfsclone @{exec_path} = @{sbin}/ntfsclone
profile ntfsclone @{exec_path} { profile ntfsclone @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/disks-write> include <abstractions/disks-write>

2
apparmor.d/groups/filesystem/ntfscp
View file

@ -7,7 +7,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/ntfscp @{exec_path} = @{sbin}/ntfscp
profile ntfscp @{exec_path} { profile ntfscp @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/disks-write> include <abstractions/disks-write>

2
apparmor.d/groups/filesystem/ntfslabel
View file

@ -7,7 +7,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/ntfslabel @{exec_path} = @{sbin}/ntfslabel
profile ntfslabel @{exec_path} { profile ntfslabel @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/disks-write> include <abstractions/disks-write>

2
apparmor.d/groups/filesystem/ntfsresize
View file

@ -7,7 +7,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/ntfsresize @{exec_path} = @{sbin}/ntfsresize
profile ntfsresize @{exec_path} { profile ntfsresize @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/disks-write> include <abstractions/disks-write>

2
apparmor.d/groups/filesystem/ntfsundelete
View file

@ -7,7 +7,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/ntfsundelete @{exec_path} = @{sbin}/ntfsundelete
profile ntfsundelete @{exec_path} { profile ntfsundelete @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/disks-read> include <abstractions/disks-read>

16
apparmor.d/groups/filesystem/udisksd
View file

@ -73,18 +73,18 @@ profile udisksd @{exec_path} flags=(attach_disconnected) {
@{sh_path} rix, @{sh_path} rix,
@{bin}/umount rix, @{bin}/umount rix,
@{bin}/dmidecode rPx, @{sbin}/dmidecode rPx,
@{bin}/dumpe2fs rPx, @{sbin}/dumpe2fs rPx,
@{bin}/eject rPx, @{bin}/eject rPx,
@{bin}/fsck.fat rPx, @{sbin}/fsck.fat rPx,
@{bin}/lvm rPUx, @{sbin}/lvm rPUx,
@{bin}/mke2fs rPx, @{sbin}/mke2fs rPx,
@{bin}/mkfs.* rPx, @{sbin}/mkfs.* rPx,
@{bin}/mount.exfat-fuse rPUx, @{bin}/mount.exfat-fuse rPUx,
@{bin}/ntfs-3g rPx, @{bin}/ntfs-3g rPx,
@{bin}/ntfsfix rPx, @{bin}/ntfsfix rPx,
@{bin}/sfdisk rPx, @{sbin}/sfdisk rPx,
@{bin}/sgdisk rPx, @{sbin}/sgdisk rPx,
@{bin}/systemctl rCx -> systemctl, @{bin}/systemctl rCx -> systemctl,
@{bin}/systemd-escape rPx, @{bin}/systemd-escape rPx,
@{bin}/xfs_* rPUx, @{bin}/xfs_* rPUx,

2
apparmor.d/groups/filesystem/umount.udisks2
View file

@ -7,7 +7,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/umount.udisks2 @{exec_path} = @{sbin}/umount.udisks2
profile umount.udisks2 @{exec_path} flags=(complain) { profile umount.udisks2 @{exec_path} flags=(complain) {
include <abstractions/base> include <abstractions/base>

14
apparmor.d/groups/firewall/firewalld
View file

@ -6,7 +6,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/firewalld @{exec_path} = @{sbin}/firewalld
profile firewalld @{exec_path} flags=(attach_disconnected) { profile firewalld @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/app/kmod> include <abstractions/app/kmod>
@ -34,14 +34,14 @@ profile firewalld @{exec_path} flags=(attach_disconnected) {
@{bin}/ r, @{bin}/ r,
@{bin}/alts rix, @{bin}/alts rix,
@{bin}/ebtables-legacy rix, @{sbin}/ebtables-legacy rix,
@{bin}/ebtables-legacy-restore rix, @{sbin}/ebtables-legacy-restore rix,
@{bin}/false rix, @{bin}/false rix,
@{bin}/ipset rix, @{sbin}/ipset rix,
@{bin}/kmod rix, @{bin}/kmod rix,
@{bin}/modprobe rix, @{sbin}/modprobe rix,
@{bin}/xtables-legacy-multi rix, @{sbin}/xtables-legacy-multi rix,
@{bin}/xtables-nft-multi rmix, @{sbin}/xtables-nft-multi rmix,
/usr/local/lib/@{python_name}/dist-packages/ r, /usr/local/lib/@{python_name}/dist-packages/ r,

2
apparmor.d/groups/firewall/nft
View file

@ -7,7 +7,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/nft @{exec_path} = @{sbin}/nft
profile nft @{exec_path} { profile nft @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>

6
apparmor.d/groups/firewall/ufw
View file

@ -33,9 +33,9 @@ profile ufw @{exec_path} flags=(attach_disconnected) {
@{bin}/ r, @{bin}/ r,
@{bin}/cat rix, @{bin}/cat rix,
@{bin}/env r, @{bin}/env r,
@{bin}/sysctl rix, @{sbin}/sysctl rix,
@{bin}/xtables-legacy-multi rix, @{sbin}/xtables-legacy-multi rix,
@{bin}/xtables-nft-multi rix, @{sbin}/xtables-nft-multi rix,
@{lib}/ufw/ufw-init rix, @{lib}/ufw/ufw-init rix,
/etc/default/ufw rw, /etc/default/ufw rw,

6
apparmor.d/groups/firewall/ufw-init
View file

@ -22,9 +22,9 @@ profile ufw-init @{exec_path} {
@{exec_path} mr, @{exec_path} mr,
@{sh_path} rix, @{sh_path} rix,
@{bin}/sysctl rix, @{sbin}/sysctl rix,
@{bin}/xtables-legacy-multi rix, @{sbin}/xtables-legacy-multi rix,
@{bin}/xtables-nft-multi rix, @{sbin}/xtables-nft-multi rix,
/etc/default/ufw r, /etc/default/ufw r,
/etc/ufw/* r, /etc/ufw/* r,

2
apparmor.d/groups/flatpak/flatpak-app
View file

@ -65,7 +65,7 @@ profile flatpak-app flags=(attach_disconnected,mediate_deleted) {
@{bin}/gtk{,4}-update-icon-cache rPx -> flatpak-app//&gtk-update-icon-cache, @{bin}/gtk{,4}-update-icon-cache rPx -> flatpak-app//&gtk-update-icon-cache,
@{bin}/update-desktop-database rPx -> flatpak-app//&update-desktop-database, @{bin}/update-desktop-database rPx -> flatpak-app//&update-desktop-database,
@{bin}/update-mime-database rPx -> flatpak-app//&update-mime-database, @{sbin}/update-mime-database rPx -> flatpak-app//&update-mime-database,
@{bin}/xdg-dbus-proxy rPx -> flatpak-app//&xdg-dbus-proxy, @{bin}/xdg-dbus-proxy rPx -> flatpak-app//&xdg-dbus-proxy,
@{lib}/kf5/kioslave5 rPx, @{lib}/kf5/kioslave5 rPx,

8
apparmor.d/groups/freedesktop/accounts-daemon
View file

@ -27,13 +27,13 @@ profile accounts-daemon @{exec_path} flags=(attach_disconnected) {
@{exec_path} mr, @{exec_path} mr,
@{bin}/adduser rPx, @{sbin}/adduser rPx,
@{bin}/cat rix, @{bin}/cat rix,
@{bin}/chage rPx, @{bin}/chage rPx,
@{bin}/passwd rPx, @{bin}/passwd rPx,
@{bin}/chpasswd rPx, @{sbin}/chpasswd rPx,
@{bin}/userdel rPx, @{sbin}/userdel rPx,
@{bin}/usermod rPx, @{sbin}/usermod rPx,
@{bin}/locale rPUx, @{bin}/locale rPUx,
/usr/share/language-tools/language-validate rPx, /usr/share/language-tools/language-validate rPx,

2
apparmor.d/groups/freedesktop/plymouthd
View file

@ -6,7 +6,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/plymouthd @{exec_path} = @{sbin}/plymouthd
profile plymouthd @{exec_path} { profile plymouthd @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>

2
apparmor.d/groups/freedesktop/update-mime-database
View file

@ -6,7 +6,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/update-mime-database @{exec_path} = @{sbin}/update-mime-database
profile update-mime-database @{exec_path} flags=(attach_disconnected) { profile update-mime-database @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>

4
apparmor.d/groups/gnome/gnome-control-center
View file

@ -60,11 +60,11 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
@{bin}/bwrap rCx -> bwrap, @{bin}/bwrap rCx -> bwrap,
@{bin}/gkbd-keyboard-display rPx, @{bin}/gkbd-keyboard-display rPx,
@{bin}/gnome-software rPx, @{bin}/gnome-software rPx,
@{bin}/openvpn rPx, @{sbin}/openvpn rPx,
@{bin}/passwd rPx, @{bin}/passwd rPx,
@{bin}/pkexec rCx -> pkexec, @{bin}/pkexec rCx -> pkexec,
@{bin}/software-properties-gtk rPx, @{bin}/software-properties-gtk rPx,
@{bin}/usermod rPx, @{sbin}/usermod rPx,
@{lib}/{,@{multiarch}/}webkit{2,}gtk-*/WebKitNetworkProcess rix, @{lib}/{,@{multiarch}/}webkit{2,}gtk-*/WebKitNetworkProcess rix,
@{lib}/cups/backend/snmp rPx, @{lib}/cups/backend/snmp rPx,
@{lib}/gnome-control-center-goa-helper rPx, @{lib}/gnome-control-center-goa-helper rPx,

2
apparmor.d/groups/grub/grub-install
View file

@ -7,7 +7,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/grub-install @{exec_path} = @{sbin}/grub-install
profile grub-install @{exec_path} flags=(complain) { profile grub-install @{exec_path} flags=(complain) {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>

2
apparmor.d/groups/grub/grub-macbless
View file

@ -6,7 +6,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/grub-macbless @{exec_path} = @{sbin}/grub-macbless
profile grub-macbless @{exec_path} { profile grub-macbless @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>

6
apparmor.d/groups/grub/grub-mkconfig
View file

@ -7,7 +7,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/grub-mkconfig @{exec_path} = @{sbin}/grub-mkconfig
profile grub-mkconfig @{exec_path} flags=(attach_disconnected) { profile grub-mkconfig @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>
@ -27,14 +27,14 @@ profile grub-mkconfig @{exec_path} flags=(attach_disconnected) {
@{bin}/cut rix, @{bin}/cut rix,
@{bin}/date rix, @{bin}/date rix,
@{bin}/dirname rix, @{bin}/dirname rix,
@{bin}/dmsetup rPUx, @{sbin}/dmsetup rPUx,
@{bin}/dpkg rPx, @{bin}/dpkg rPx,
@{bin}/find rix, @{bin}/find rix,
@{bin}/findmnt rPx, @{bin}/findmnt rPx,
@{bin}/gettext rix, @{bin}/gettext rix,
@{bin}/grub-editenv rPx, @{bin}/grub-editenv rPx,
@{bin}/grub-mkrelpath rPx, @{bin}/grub-mkrelpath rPx,
@{bin}/grub-probe rPx, @{sbin}/grub-probe rPx,
@{bin}/grub-script-check rPx, @{bin}/grub-script-check rPx,
@{bin}/head rix, @{bin}/head rix,
@{bin}/id rPx, @{bin}/id rPx,

2
apparmor.d/groups/grub/grub-mkdevicemap
View file

@ -6,7 +6,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/grub-mkdevicemap @{exec_path} = @{sbin}/grub-mkdevicemap
profile grub-mkdevicemap @{exec_path} { profile grub-mkdevicemap @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>

2
apparmor.d/groups/grub/grub-multi-install
View file

@ -13,7 +13,7 @@ profile grub-multi-install @{exec_path} {
@{exec_path} mr, @{exec_path} mr,
@{bin}/grub-install rPx, @{sbin}/grub-install rPx,
@{sh_path} rix, @{sh_path} rix,
@{bin}/{,e}grep rix, @{bin}/{,e}grep rix,
@{bin}/cat rix, @{bin}/cat rix,

4
apparmor.d/groups/grub/grub-probe
View file

@ -7,7 +7,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/grub-probe @{exec_path} = @{sbin}/grub-probe
profile grub-probe @{exec_path} { profile grub-probe @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>
@ -20,7 +20,7 @@ profile grub-probe @{exec_path} {
/{usr/,}{local/,}{s,}bin/zpool rPx, /{usr/,}{local/,}{s,}bin/zpool rPx,
@{bin}/lsb_release rPx -> lsb_release, @{bin}/lsb_release rPx -> lsb_release,
@{bin}/lvm rPx, @{sbin}/lvm rPx,
@{bin}/udevadm rPx, @{bin}/udevadm rPx,
/usr/share/grub/* r, /usr/share/grub/* r,

2
apparmor.d/groups/grub/grub-reboot
View file

@ -6,7 +6,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/grub-reboot @{exec_path} = @{sbin}/grub-reboot
profile grub-reboot @{exec_path} { profile grub-reboot @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>

2
apparmor.d/groups/grub/grub-set-default
View file

@ -6,7 +6,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/grub-set-default @{exec_path} = @{sbin}/grub-set-default
profile grub-set-default @{exec_path} { profile grub-set-default @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>

4
apparmor.d/groups/grub/update-grub
View file

@ -6,7 +6,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/update-grub{2,} @{exec_path} = @{sbin}/update-grub{2,}
profile update-grub @{exec_path} { profile update-grub @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>
@ -15,7 +15,7 @@ profile update-grub @{exec_path} {
@{exec_path} mr, @{exec_path} mr,
@{sh_path} rix, @{sh_path} rix,
@{bin}/grub-mkconfig rPx, @{sbin}/grub-mkconfig rPx,
/dev/tty@{int} rw, /dev/tty@{int} rw,

2
apparmor.d/groups/kde/kauth-kded-smart-helper
View file

@ -22,7 +22,7 @@ profile kauth-kded-smart-helper @{exec_path} {
@{exec_path} mr, @{exec_path} mr,
@{bin}/smartctl rPx, @{sbin}/smartctl rPx,
/usr/share/icu/@{int}.@{int}/*.dat r, /usr/share/icu/@{int}.@{int}/*.dat r,

2
apparmor.d/groups/kde/kauth-kinfocenter-dmidecode-helper
View file

@ -13,7 +13,7 @@ profile kauth-kinfocenter-dmidecode-helper @{exec_path} {
@{exec_path} mr, @{exec_path} mr,
@{bin}/dmidecode rPx, @{sbin}/dmidecode rPx,
include if exists <local/kauth-kinfocenter-dmidecode-helper> include if exists <local/kauth-kinfocenter-dmidecode-helper>
} }

2
apparmor.d/groups/kde/kscreenlocker_greet
View file

@ -39,7 +39,7 @@ profile kscreenlocker_greet @{exec_path} {
@{lib}/libheif/ r, @{lib}/libheif/ r,
@{lib}/libheif/*.so* rm, @{lib}/libheif/*.so* rm,
@{bin}/unix_chkpwd rPx, @{sbin}/unix_chkpwd rPx,
@{lib}/@{multiarch}/libexec/kcheckpass rPx, @{lib}/@{multiarch}/libexec/kcheckpass rPx,
/usr/share/plasma/** r, /usr/share/plasma/** r,

2
apparmor.d/groups/kde/sddm-xsession
View file

@ -37,7 +37,7 @@ profile sddm-xsession @{exec_path} {
@{bin}/sed rix, @{bin}/sed rix,
@{bin}/stat rix, @{bin}/stat rix,
@{bin}/tail rix, @{bin}/tail rix,
@{bin}/tcsh rix, @{sbin}/tcsh rix,
@{bin}/tempfile rix, @{bin}/tempfile rix,
@{bin}/touch rix, @{bin}/touch rix,
@{bin}/which{,.*} rix, @{bin}/which{,.*} rix,

2
apparmor.d/groups/network/ModemManager
View file

@ -6,7 +6,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/ModemManager @{exec_path} = @{sbin}/ModemManager
profile ModemManager @{exec_path} flags=(attach_disconnected) { profile ModemManager @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/bus-system> include <abstractions/bus-system>

8
apparmor.d/groups/network/NetworkManager
View file

@ -6,7 +6,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/NetworkManager @{exec_path} = @{sbin}/NetworkManager
profile NetworkManager @{exec_path} flags=(attach_disconnected) { profile NetworkManager @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/bus-system> include <abstractions/bus-system>
@ -75,12 +75,12 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) {
@{exec_path} mr, @{exec_path} mr,
@{sh_path} rix, @{sh_path} rix,
@{bin}/nft rix, @{sbin}/nft rix,
@{bin}/dnsmasq rPx, @{sbin}/dnsmasq rPx,
@{bin}/kmod rPx, @{bin}/kmod rPx,
@{bin}/netconfig rPUx, @{bin}/netconfig rPUx,
@{bin}/resolvconf rPx, @{sbin}/resolvconf rPx,
@{bin}/systemctl rCx -> systemctl, @{bin}/systemctl rCx -> systemctl,
@{lib}/{,NetworkManager/}nm-daemon-helper rPx, @{lib}/{,NetworkManager/}nm-daemon-helper rPx,
@{lib}/{,NetworkManager/}nm-dhcp-helper rPx, @{lib}/{,NetworkManager/}nm-dhcp-helper rPx,

4
apparmor.d/groups/network/dhcpcd
View file

@ -6,7 +6,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/dhcpcd @{exec_path} = @{sbin}/dhcpcd
profile dhcpcd @{exec_path} flags=(attach_disconnected) { profile dhcpcd @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
@ -35,7 +35,7 @@ profile dhcpcd @{exec_path} flags=(attach_disconnected) {
@{bin}/chmod rix, @{bin}/chmod rix,
@{bin}/cmp rix, @{bin}/cmp rix,
@{bin}/mkdir rix, @{bin}/mkdir rix,
@{bin}/resolvconf rPx, @{sbin}/resolvconf rPx,
@{bin}/rm rix, @{bin}/rm rix,
@{bin}/sed rix, @{bin}/sed rix,
@{lib}/dhcpcd/dhcpcd-run-hooks rix, @{lib}/dhcpcd/dhcpcd-run-hooks rix,

2
apparmor.d/groups/network/iwctl
View file

@ -6,7 +6,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/iwctl @{exec_path} = @{sbin}/iwctl
profile iwctl @{exec_path} { profile iwctl @{exec_path} {
include <abstractions/base> include <abstractions/base>

2
apparmor.d/groups/network/iwd
View file

@ -24,7 +24,7 @@ profile iwd @{exec_path} {
network packet dgram, network packet dgram,
@{exec_path} mr, @{exec_path} mr,
@{bin}/resolvconf rPx, @{sbin}/resolvconf rPx,
/etc/iwd/{,**} r, /etc/iwd/{,**} r,
/var/lib/iwd/{,**} rw, /var/lib/iwd/{,**} rw,

2
apparmor.d/groups/network/mullvad-daemon
View file

@ -33,7 +33,7 @@ profile mullvad-daemon @{exec_path} flags=(attach_disconnected) {
@{exec_path} mr, @{exec_path} mr,
@{bin}/ip rix, @{sbin}/ip rix,
"/opt/Mullvad VPN/resources/openvpn" rix, "/opt/Mullvad VPN/resources/openvpn" rix,
"/opt/Mullvad VPN/resources/*.so*" mr, "/opt/Mullvad VPN/resources/*.so*" mr,

4
apparmor.d/groups/network/nm-dispatcher
View file

@ -39,7 +39,7 @@ profile nm-dispatcher @{exec_path} flags=(attach_disconnected) {
@{bin}/gawk rix, @{bin}/gawk rix,
@{bin}/grep rix, @{bin}/grep rix,
@{bin}/id rix, @{bin}/id rix,
@{bin}/invoke-rc.d rCx -> invoke-rc, @{sbin}/invoke-rc.d rCx -> invoke-rc,
@{bin}/logger rix, @{bin}/logger rix,
@{bin}/mkdir rix, @{bin}/mkdir rix,
@{bin}/mktemp rix, @{bin}/mktemp rix,
@ -101,7 +101,7 @@ profile nm-dispatcher @{exec_path} flags=(attach_disconnected) {
profile invoke-rc { profile invoke-rc {
include <abstractions/base> include <abstractions/base>
@{bin}/invoke-rc.d rm, @{sbin}/invoke-rc.d rm,
@{sh_path} rix, @{sh_path} rix,
@{bin}/basename rix, @{bin}/basename rix,
@{bin}/ls rix, @{bin}/ls rix,

2
apparmor.d/groups/network/nm-openvpn-service
View file

@ -20,7 +20,7 @@ profile nm-openvpn-service @{exec_path} {
@{sh_path} rix, @{sh_path} rix,
@{bin}/kmod rPx, @{bin}/kmod rPx,
@{bin}/openvpn rPx, @{sbin}/openvpn rPx,
@{lib}/{,NetworkManager/}nm-openvpn-auth-dialog rPx, @{lib}/{,NetworkManager/}nm-openvpn-auth-dialog rPx,
@{lib}/{,NetworkManager/}nm-openvpn-service-openvpn-helper rPx, @{lib}/{,NetworkManager/}nm-openvpn-service-openvpn-helper rPx,

12
apparmor.d/groups/network/openvpn
View file

@ -22,7 +22,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/openvpn @{exec_path} = @{sbin}/openvpn
profile openvpn @{exec_path} flags=(attach_disconnected) { profile openvpn @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
@ -61,7 +61,7 @@ profile openvpn @{exec_path} flags=(attach_disconnected) {
@{run}/openvpn/*.{pid,status} rw, @{run}/openvpn/*.{pid,status} rw,
@{run}/systemd/journal/dev-log r, @{run}/systemd/journal/dev-log r,
@{bin}/ip rix, @{sbin}/ip rix,
@{bin}/systemd-ask-password rPx, @{bin}/systemd-ask-password rPx,
@{lib}/nm-openvpn-service-openvpn-helper rPx, @{lib}/nm-openvpn-service-openvpn-helper rPx,
/etc/openvpn/force-user-traffic-via-vpn.sh rCx -> force-user-traffic-via-vpn, /etc/openvpn/force-user-traffic-via-vpn.sh rCx -> force-user-traffic-via-vpn,
@ -83,9 +83,9 @@ profile openvpn @{exec_path} flags=(attach_disconnected) {
@{sh_path} rix, @{sh_path} rix,
@{bin}/cut rix, @{bin}/cut rix,
@{bin}/ip rix, @{sbin}/ip rix,
@{bin}/which{,.debianutils} rix, @{bin}/which{,.debianutils} rix,
@{bin}/xtables-nft-multi rix, @{sbin}/xtables-nft-multi rix,
/etc/iproute2/rt_tables r, /etc/iproute2/rt_tables r,
/etc/iproute2/rt_tables.d/{,*} r, /etc/iproute2/rt_tables.d/{,*} r,
@ -110,8 +110,8 @@ profile openvpn @{exec_path} flags=(attach_disconnected) {
@{bin}/{,e}grep rix, @{bin}/{,e}grep rix,
@{bin}/cut rix, @{bin}/cut rix,
@{bin}/env rix, @{bin}/env rix,
@{bin}/ip rix, @{sbin}/ip rix,
@{bin}/nft rix, @{sbin}/nft rix,
@{bin}/sed rix, @{bin}/sed rix,
/etc/iproute2/rt_realms r, /etc/iproute2/rt_realms r,

2
apparmor.d/groups/network/tailscale
View file

@ -23,7 +23,7 @@ profile tailscale @{exec_path} {
@{exec_path} mr, @{exec_path} mr,
@{bin}/ip rPx, @{sbin}/ip rPx,
owner @{run}/tailscale/tailscaled.sock rw, owner @{run}/tailscale/tailscaled.sock rw,

4
apparmor.d/groups/network/tailscaled
View file

@ -35,9 +35,9 @@ profile tailscaled @{exec_path} flags=(attach_disconnected) {
@{exec_path} mr, @{exec_path} mr,
@{bin}/ip rix, @{sbin}/ip rix,
@{bin}/resolvectl rPx, @{bin}/resolvectl rPx,
@{bin}/xtables-nft-multi rix, @{sbin}/xtables-nft-multi rix,
@{bin}/systemctl rCx -> systemctl, @{bin}/systemctl rCx -> systemctl,

12
apparmor.d/groups/network/wg-quick
View file

@ -21,19 +21,19 @@ profile wg-quick @{exec_path} flags=(attach_disconnected) {
@{sh_path} rix, @{sh_path} rix,
@{bin}/cat rix, @{bin}/cat rix,
@{bin}/ip rPx, @{sbin}/ip rPx,
@{bin}/mv rix, @{bin}/mv rix,
@{bin}/nft rix, @{sbin}/nft rix,
@{bin}/readlink rix, @{bin}/readlink rix,
@{bin}/resolvconf rPx, @{sbin}/resolvconf rPx,
@{bin}/resolvectl rPx, @{bin}/resolvectl rPx,
@{bin}/rm rix, @{bin}/rm rix,
@{bin}/sort rix, @{bin}/sort rix,
@{bin}/stat rix, @{bin}/stat rix,
@{bin}/sync rix, @{bin}/sync rix,
@{bin}/sysctl rCx -> sysctl, @{sbin}/sysctl rCx -> sysctl,
@{bin}/wg rPx, @{bin}/wg rPx,
@{bin}/xtables-nft-multi rix, @{sbin}/xtables-nft-multi rix,
/usr/share/terminfo/** r, /usr/share/terminfo/** r,
@ -49,7 +49,7 @@ profile wg-quick @{exec_path} flags=(attach_disconnected) {
profile sysctl flags=(attach_disconnected) { profile sysctl flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
@{bin}/sysctl mr, @{sbin}/sysctl mr,
@{PROC}/sys/net/ipv4/conf/all/src_valid_mark w, @{PROC}/sys/net/ipv4/conf/all/src_valid_mark w,

6
apparmor.d/groups/pacman/mkinitcpio
View file

@ -28,11 +28,11 @@ profile mkinitcpio @{exec_path} flags=(attach_disconnected) {
@{bin}/bsdtar rix, @{bin}/bsdtar rix,
@{bin}/fc-match rix, @{bin}/fc-match rix,
@{bin}/findmnt rPx, @{bin}/findmnt rPx,
@{bin}/fsck rix, @{sbin}/fsck rix,
@{bin}/getent rix, @{bin}/getent rix,
@{bin}/gzip rix, @{bin}/gzip rix,
@{bin}/hexdump rix, @{bin}/hexdump rix,
@{bin}/ldconfig rix, @{sbin}/ldconfig rix,
@{bin}/ldd rix, @{bin}/ldd rix,
@{bin}/loadkeys rix, @{bin}/loadkeys rix,
@{bin}/objcopy rix, @{bin}/objcopy rix,
@ -45,7 +45,7 @@ profile mkinitcpio @{exec_path} flags=(attach_disconnected) {
@{bin}/{depmod,insmod} rPx, @{bin}/{depmod,insmod} rPx,
@{bin}/{kmod,lsmod} rPx, @{bin}/{kmod,lsmod} rPx,
@{bin}/{modinfo,rmmod} rPx, @{bin}/{modinfo,rmmod} rPx,
@{bin}/modprobe rPx, @{sbin}/modprobe rPx,
@{bin}/plymouth rPx, @{bin}/plymouth rPx,
@{bin}/plymouth-set-default-theme rPx, @{bin}/plymouth-set-default-theme rPx,
@{bin}/sbctl rPx, @{bin}/sbctl rPx,

18
apparmor.d/groups/pacman/pacman
View file

@ -69,35 +69,35 @@ profile pacman @{exec_path} flags=(attach_disconnected) {
@{bin}/ghc-pkg-@{version} rix, @{bin}/ghc-pkg-@{version} rix,
@{bin}/gio-querymodules rPx, @{bin}/gio-querymodules rPx,
@{bin}/glib-compile-schemas rPx, @{bin}/glib-compile-schemas rPx,
@{bin}/groupadd rPx, @{sbin}/groupadd rPx,
@{bin}/gtk-query-immodules-{2,3}.0 rPx, @{bin}/gtk-query-immodules-{2,3}.0 rPx,
@{bin}/gtk{,4}-update-icon-cache rPx, @{bin}/gtk{,4}-update-icon-cache rPx,
@{bin}/iconvconfig rix, @{sbin}/iconvconfig rix,
@{bin}/install-catalog rPx, @{bin}/install-catalog rPx,
@{bin}/install-info rPx, @{bin}/install-info rPx,
@{bin}/iscsi-iname rix, @{bin}/iscsi-iname rix,
@{bin}/journalctl rPx, @{bin}/journalctl rPx,
@{bin}/killall rix, @{bin}/killall rix,
@{bin}/ldconfig rix, @{sbin}/ldconfig rix,
@{bin}/locale-gen rPx, @{sbin}/locale-gen rPx,
@{bin}/mkinitcpio rPx, @{bin}/mkinitcpio rPx,
@{bin}/needrestart rPx, @{sbin}/needrestart rPx,
@{bin}/pacdiff rPx, @{bin}/pacdiff rPx,
@{bin}/pacman-key rPx, @{bin}/pacman-key rPx,
@{bin}/pkgfile rPUx, @{bin}/pkgfile rPUx,
@{bin}/pkill rix, @{bin}/pkill rix,
@{bin}/rsync rix, @{bin}/rsync rix,
@{bin}/sbctl rPx, @{bin}/sbctl rPx,
@{bin}/setcap rix, @{sbin}/setcap rix,
@{bin}/setfacl rix, @{bin}/setfacl rix,
@{bin}/sysctl rPx, @{sbin}/sysctl rPx,
@{bin}/systemctl rCx -> systemctl, @{bin}/systemctl rCx -> systemctl,
@{bin}/systemd-* rPx, @{bin}/systemd-* rPx,
@{bin}/tput rix, @{bin}/tput rix,
@{bin}/update-ca-trust rPx, @{bin}/update-ca-trust rPx,
@{bin}/update-desktop-database rPx, @{bin}/update-desktop-database rPx,
@{bin}/update-grub rPx, @{sbin}/update-grub rPx,
@{bin}/update-mime-database rPx, @{sbin}/update-mime-database rPx,
@{bin}/vercmp rix, @{bin}/vercmp rix,
@{bin}/which rix, @{bin}/which rix,
@{bin}/xmlcatalog rix, @{bin}/xmlcatalog rix,

2
apparmor.d/groups/pacman/pacman-hook-depmod
View file

@ -16,7 +16,7 @@ profile pacman-hook-depmod @{exec_path} {
@{bin}/basename rix, @{bin}/basename rix,
@{bin}/bash rix, @{bin}/bash rix,
@{bin}/depmod rPx, @{sbin}/depmod rPx,
@{bin}/kmod rPx, @{bin}/kmod rPx,
@{bin}/rm rix, @{bin}/rm rix,
@{bin}/rmdir rix, @{bin}/rmdir rix,

2
apparmor.d/groups/pacman/pacman-hook-dkms
View file

@ -19,7 +19,7 @@ profile pacman-hook-dkms @{exec_path} flags=(attach_disconnected) {
@{exec_path} mr, @{exec_path} mr,
@{sh_path} rix, @{sh_path} rix,
@{bin}/dkms rPx, @{sbin}/dkms rPx,
@{bin}/kmod rPx, @{bin}/kmod rPx,
@{bin}/nproc rix, @{bin}/nproc rix,

2
apparmor.d/groups/procps/sysctl
View file

@ -8,7 +8,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/sysctl @{exec_path} = @{sbin}/sysctl
profile sysctl @{exec_path} { profile sysctl @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>

2
apparmor.d/groups/shadow/chpasswd
View file

@ -6,7 +6,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/chpasswd @{exec_path} = @{sbin}/chpasswd
profile chpasswd @{exec_path} { profile chpasswd @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/bus-system> include <abstractions/bus-system>

2
apparmor.d/groups/shadow/groupadd
View file

@ -7,7 +7,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/groupadd @{exec_path} = @{sbin}/groupadd
profile groupadd @{exec_path} { profile groupadd @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>

2
apparmor.d/groups/shadow/groupdel
View file

@ -7,7 +7,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/groupdel @{exec_path} = @{sbin}/groupdel
profile groupdel @{exec_path} { profile groupdel @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>

2
apparmor.d/groups/shadow/groupmod
View file

@ -7,7 +7,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/groupmod @{exec_path} = @{sbin}/groupmod
profile groupmod @{exec_path} { profile groupmod @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>

2
apparmor.d/groups/shadow/grpck
View file

@ -7,7 +7,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/grpck @{exec_path} = @{sbin}/grpck
profile grpck @{exec_path} flags=(attach_disconnected) { profile grpck @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>

2
apparmor.d/groups/shadow/pwck
View file

@ -6,7 +6,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/pwck @{exec_path} = @{sbin}/pwck
profile pwck @{exec_path} flags=(attach_disconnected) { profile pwck @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>

4
apparmor.d/groups/shadow/useradd
View file

@ -7,7 +7,7 @@ abi <abi/4.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{bin}/useradd @{exec_path} = @{sbin}/useradd
profile useradd @{exec_path} { profile useradd @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>
@ -25,7 +25,7 @@ profile useradd @{exec_path} {
@{exec_path} mr, @{exec_path} mr,
@{bin}/nscd rix, @{bin}/nscd rix,
@{bin}/usermod rPx, @{sbin}/usermod rPx,
@{bin}/pam_tally2 rCx -> pam_tally2, @{bin}/pam_tally2 rCx -> pam_tally2,

Some files were not shown because too many files have changed in this diff Show more