felipe/apparmor.d
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(profile): update arch profiles.

Browse source
This commit is contained in:
Alexandre Pujol 2025-09-11 23:11:25 +02:00
parent d0657d2c26
commit ff8efaecd2
No known key found for this signature in database
GPG key ID: C5469996F0DF68EC
2 changed files with 23 additions and 12 deletions
Download patch file Download diff file Expand all files Collapse all files

33
apparmor.d/groups/pacman/pacdiff
View file

@ -9,7 +9,6 @@ include <tunables/global>
@{exec_path} = @{bin}/pacdiff @{exec_path} = @{bin}/pacdiff
profile pacdiff @{exec_path} flags=(attach_disconnected) { profile pacdiff @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/app/editor>
capability dac_read_search, capability dac_read_search,
capability mknod, capability mknod,
@ -20,17 +19,18 @@ profile pacdiff @{exec_path} flags=(attach_disconnected) {
@{exec_path} mr, @{exec_path} mr,
@{sh_path} rix, @{sh_path} rix,
@{bin}/{m,g,}awk rix, @{bin}/{m,g,}awk ix,
@{bin}/cat rix, @{bin}/cat ix,
@{bin}/cmp rix, @{bin}/cmp ix,
@{bin}/find rix, @{bin}/find ix,
@{bin}/locate rix, @{bin}/locate ix,
@{bin}/pacman rix, @{bin}/pacman ix,
@{bin}/pacman-conf rPx, @{bin}/pacman-conf Px,
@{bin}/pacsort rix, @{bin}/pacsort ix,
@{bin}/rm rix, @{bin}/rm ix,
@{bin}/sed rix, @{bin}/sed ix,
@{bin}/tput rix, @{bin}/tput ix,
@{editor_path} Cx -> editor,
# packages files # packages files
/ r, / r,
@ -44,6 +44,15 @@ profile pacdiff @{exec_path} flags=(attach_disconnected) {
/dev/tty rw, /dev/tty rw,
/dev/pts/@{int} rw, /dev/pts/@{int} rw,
profile editor {
include <abstractions/base>
include <abstractions/app/editor>
/etc/** rw,
include if exists <local/pacdiff_editor>
}
include if exists <local/pacdiff> include if exists <local/pacdiff>
} }

2
apparmor.d/groups/pacman/pacman-hook-systemd
View file

@ -46,6 +46,8 @@ profile pacman-hook-systemd @{exec_path} {
capability net_admin, capability net_admin,
capability sys_resource, capability sys_resource,
ptrace read peer=@{p_systemd},
signal send set=(cont, term) peer=systemd-tty-ask-password-agent, signal send set=(cont, term) peer=systemd-tty-ask-password-agent,
@{bin}/systemd-tty-ask-password-agent Px, @{bin}/systemd-tty-ask-password-agent Px,