181 lines
4.2 KiB
Text
181 lines
4.2 KiB
Text
# apparmor.d - Full set of apparmor profiles
|
|
# Copyright (C) 2019-2021 Mikhail Morfikov
|
|
# SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
abi <abi/3.0>,
|
|
|
|
include <tunables/global>
|
|
|
|
@{exec_path} = /{,usr/}{,local/}bin/spectre-meltdown-checker{,.sh}
|
|
profile spectre-meltdown-checker @{exec_path} {
|
|
include <abstractions/base>
|
|
|
|
# Needed to read the /dev/cpu/[0-9]*/msr device
|
|
capability sys_rawio,
|
|
|
|
# Needed to read system logs
|
|
capability syslog,
|
|
|
|
# Used by readlink
|
|
capability sys_ptrace,
|
|
ptrace (read),
|
|
|
|
@{exec_path} r,
|
|
/{usr/,}bin/{,ba,da}sh rix,
|
|
|
|
/{usr/,}bin/ r,
|
|
/{usr/,}bin/dirname rix,
|
|
/{usr/,}bin/uname rix,
|
|
/{usr/,}bin/cut rix,
|
|
/{usr/,}bin/{,e}grep rix,
|
|
/{usr/,}bin/head rix,
|
|
/{usr/,}bin/{,g,m}awk rix,
|
|
/{usr/,}bin/sed rix,
|
|
/{usr/,}bin/od rix,
|
|
/{usr/,}bin/dd rix,
|
|
/{usr/,}bin/id rix,
|
|
/{usr/,}bin/gunzip rix,
|
|
/{usr/,}bin/gzip rix,
|
|
/{usr/,}bin/zstd rix,
|
|
/{usr/,}bin/bunzip2 rix,
|
|
/{usr/,}bin/lzop rix,
|
|
/{usr/,}bin/mktemp rix,
|
|
/{usr/,}bin/tr rix,
|
|
/{usr/,}bin/stat rix,
|
|
/{usr/,}bin/tail rix,
|
|
/{usr/,}bin/xz rix,
|
|
/{usr/,}bin/seq rix,
|
|
/{usr/,}bin/rm rix,
|
|
/{usr/,}bin/sort rix,
|
|
/{usr/,}bin/cat rix,
|
|
/{usr/,}bin/basename rix,
|
|
/{usr/,}bin/perl rix,
|
|
/{usr/,}bin/base64 rix,
|
|
/{usr/,}bin/unzip rix,
|
|
/{usr/,}bin/{,@{multiarch}-}readelf rix,
|
|
/{usr/,}bin/{,@{multiarch}-}strings rix,
|
|
/{usr/,}bin/{,@{multiarch}-}objdump rix,
|
|
/{usr/,}{s,}bin/iucode_tool rix,
|
|
/{usr/,}bin/dmesg rix,
|
|
/{usr/,}{s,}bin/mount rix,
|
|
/{usr/,}bin/find rix,
|
|
/{usr/,}bin/xargs rix,
|
|
/{usr/,}bin/readlink rix,
|
|
|
|
/{usr/,}bin/pgrep rCx -> pgrep,
|
|
/{usr/,}bin/ccache rCx -> ccache,
|
|
/{usr/,}bin/kmod rCx -> kmod,
|
|
|
|
# To fetch MCE.db from the MCExtractor project
|
|
/{usr/,}bin/wget rCx -> mcedb,
|
|
/{usr/,}bin/sqlite3 rCx -> mcedb,
|
|
owner /tmp/mcedb-* rw,
|
|
owner /tmp/smc-* rw,
|
|
owner /tmp/intelfw-*/ rw,
|
|
owner /tmp/intelfw-*/fw.zip rw,
|
|
owner /tmp/intelfw-*/Intel-Linux-Processor-Microcode-Data-Files-master/ rw,
|
|
owner /tmp/intelfw-*/Intel-Linux-Processor-Microcode-Data-Files-master/** rw,
|
|
|
|
owner @{HOME}/.mcedb rw,
|
|
owner @{exec_path} w,
|
|
|
|
/tmp/ r,
|
|
owner /tmp/{config,kernel}-* rw,
|
|
|
|
owner /dev/cpu/[0-9]*/cpuid r,
|
|
owner /dev/cpu/[0-9]*/msr rw,
|
|
owner /dev/kmsg r,
|
|
|
|
/boot/ r,
|
|
/boot/{config,vmlinuz,System.map}-* r,
|
|
|
|
@{sys}/devices/system/cpu/vulnerabilities/* r,
|
|
@{sys}/module/kvm_intel/parameters/ept r,
|
|
|
|
@{PROC}/ r,
|
|
@{PROC}/config.gz r,
|
|
@{PROC}/cmdline r,
|
|
@{PROC}/kallsyms r,
|
|
@{PROC}/modules r,
|
|
|
|
# find and denoise
|
|
@{PROC}/@{pid}/{status,exe} r,
|
|
@{PROC}/@{pid}/fd/ r,
|
|
@{PROC}/*/ r,
|
|
|
|
/var/lib/dbus/machine-id r,
|
|
/etc/machine-id r,
|
|
|
|
# For shell pwd
|
|
/root/ r,
|
|
/etc/ r,
|
|
|
|
|
|
profile ccache {
|
|
include <abstractions/base>
|
|
|
|
/{usr/,}bin/ccache mr,
|
|
|
|
/{usr/,}lib/llvm-[0-9]*/bin/clang rix,
|
|
/{usr/,}bin/{,@{multiarch}-}gcc-[0-9]* rix,
|
|
/{usr/,}bin/{,@{multiarch}-}g++-[0-9]* rix,
|
|
|
|
/media/ccache/*/** rw,
|
|
|
|
/etc/debian_version r,
|
|
|
|
}
|
|
|
|
profile pgrep {
|
|
include <abstractions/base>
|
|
|
|
/{usr/,}bin/pgrep mr,
|
|
|
|
# The /proc/ dir and the cmdline file have to be radable to avoid pgrep segfault.
|
|
@{PROC}/ r,
|
|
@{PROC}/@{pids}/cmdline r,
|
|
@{PROC}/sys/kernel/osrelease r,
|
|
@{PROC}/uptime r,
|
|
|
|
}
|
|
|
|
profile mcedb {
|
|
include <abstractions/base>
|
|
include <abstractions/consoles>
|
|
include <abstractions/nameservice-strict>
|
|
include <abstractions/openssl>
|
|
include <abstractions/ssl_certs>
|
|
|
|
/{usr/,}bin/wget mr,
|
|
/{usr/,}bin/sqlite3 mr,
|
|
|
|
/etc/wgetrc r,
|
|
owner @{HOME}/.wget-hsts rwk,
|
|
|
|
/tmp/ r,
|
|
owner /tmp/mcedb-* rwk,
|
|
owner /tmp/intelfw-*/fw.zip rw,
|
|
|
|
/usr/share/publicsuffix/public_suffix_list.* r,
|
|
|
|
}
|
|
|
|
profile kmod {
|
|
include <abstractions/base>
|
|
|
|
capability sys_module,
|
|
|
|
owner @{sys}/module/cpuid/** r,
|
|
owner @{sys}/module/msr/** r,
|
|
|
|
/{usr/,}bin/kmod mr,
|
|
|
|
/etc/modprobe.d/ r,
|
|
/etc/modprobe.d/*.conf r,
|
|
|
|
@{PROC}/cmdline r,
|
|
|
|
}
|
|
|
|
include if exists <local/spectre-meltdown-checker>
|
|
}
|