apparmor.d/apparmor.d/profiles-g-l/hw-probe

# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only

abi <abi/4.0>,

include <tunables/global>

@{exec_path} = @{bin}/hw-probe
profile hw-probe @{exec_path} flags=(attach_disconnected) {
  include <abstractions/base>
  include <abstractions/perl>
  include <abstractions/X-strict>

  capability sys_admin,

  network inet dgram,
  network inet6 dgram,

  @{exec_path} rm,

  @{sh_path}             rix,
  @{bin}/{,e}grep        rix,
  @{bin}/{m,g,}awk       rix,
  @{bin}/dd              rix,
  @{sbin}/efibootmgr     rix,
  @{bin}/efivar          rix,
  @{bin}/find            rix,
  @{bin}/md5sum          rix,
  @{bin}/pwd             rix,
  @{bin}/sleep           rix,
  @{bin}/sort            rix,
  @{bin}/tar             rix,
  @{bin}/uname           rix,

  @{bin}/acpi            rPx,
  @{bin}/amixer          rPx,
  @{bin}/aplay           rPx,
  @{sbin}/biosdecode     rPx,
  @{bin}/cpuid           rPx,
  @{bin}/cpupower        rPx,
  @{bin}/curl            rCx -> curl,
  @{bin}/df              rPx,
  @{sbin}/dkms           rPx,
  @{bin}/dmesg           rPx,
  @{sbin}/dmidecode      rPx,
  @{bin}/dpkg            rPx -> child-dpkg,
  @{bin}/edid-decode     rPx,
  @{sbin}/ethtool        rCx -> netconfig,
  @{sbin}/fdisk          rPx,
  @{bin}/glxgears        rPx,
  @{bin}/glxinfo         rPx,
  @{bin}/hciconfig       rPx,
  @{sbin}/hdparm         rPx,
  @{sbin}/hwinfo         rPx,
  @{bin}/i2cdetect       rPx,
  @{sbin}/ifconfig       rCx -> netconfig,
  @{bin}/inxi            rPx,
  @{sbin}/iw             rCx -> netconfig,
  @{sbin}/iwconfig       rCx -> netconfig,
  @{bin}/journalctl      rCx -> journalctl,
  @{bin}/killall         rCx -> killall,
  @{bin}/kmod            rCx -> kmod,
  @{bin}/lsb_release     rPx,
  @{bin}/lsblk           rPx,
  @{bin}/lscpu           rPx,
  @{bin}/lspci           rPx,
  @{bin}/lsusb           rPx,
  @{bin}/memtester       rPx,
  @{bin}/nmcli           rPx,
  @{bin}/pacman          rCx -> pacman,
  @{sbin}/rfkill         rPx,
  @{bin}/rpm             rCx -> rpm,
  @{bin}/sensors         rPx,
  @{sbin}/smartctl       rPx,
  @{bin}/systemctl       rCx -> systemctl,
  @{bin}/systemd-analyze rPx,
  @{bin}/udevadm         rCx -> udevadm,
  @{bin}/upower          rPx,
  @{bin}/uptime          rPx,
  @{bin}/usb-devices     rPx,
  @{bin}/xdpyinfo        rPx,
  @{bin}/xinput          rPx,
  @{bin}/xrandr          rPx,

  /etc/modprobe.d/{,*.conf} r,

  owner @{HOME}/HW_PROBE/{,**} rw,

  audit owner @{tmp}/*/ rw,
  owner @{tmp}/*/cpu_perf rw,

  @{sys}/class/drm/ r,
  @{sys}/class/power_supply/ r,
  @{sys}/devices/@{pci}/drm/card@{int}/*/edid r,
  @{sys}/devices/**/power_supply/*/uevent r,
  @{sys}/devices/virtual/dmi/id/* r,
  @{sys}/firmware/efi/efivars/ r,
  @{sys}/firmware/efi/efivars/* r,

  @{PROC}/bus/input/devices r,
  @{PROC}/cmdline r,
  @{PROC}/interrupts r,
  @{PROC}/ioports r,
  @{PROC}/scsi/scsi r,

  /dev/{,**} r,

  profile kmod {
    include <abstractions/base>
    include <abstractions/app/kmod>

    capability sys_module,

    @{sys}/module/compression r,

    include if exists <local/hw-probe_kmod>
  }


  profile pacman flags=(attach_disconnected) {
    include <abstractions/base>
    include <abstractions/consoles>

    @{bin}/pacman mr,

    @{bin}/gpg      rPx -> pacman//gpg,
    @{bin}/gpgconf  rPx -> pacman//gpg,
    @{bin}/gpgsm    rPx -> pacman//gpg,

    /etc/pacman.conf r,
    /etc/pacman.d/{,**} r,

    /var/lib/pacman/{,**} r,

    include if exists <local/hw-probe_pacman>
  }

  profile rpm flags=(attach_disconnected) {
    include <abstractions/base>
    include <abstractions/consoles>

    capability dac_read_search,

    @{bin}/rpm mr,

    /var/ r,
    /var/lib/ r,
    /var/lib/rpm/ r,
    /var/lib/rpm/rpmdb.sqlite rk,
    /var/lib/rpm/rpmdb.sqlite-shm rwk,
    /var/lib/rpm/rpmdb.sqlite-wal rw,

    include if exists <local/hw-probe_rpm>
  }

  profile journalctl flags=(attach_disconnected) {
    include <abstractions/base>

    @{bin}/journalctl mr,

    /var/lib/dbus/machine-id r,
    /etc/machine-id r,

    @{run}/log/ rw,
    /{run,var}/log/journal/ r,
    /{run,var}/log/journal/@{hex32}/ r,
    /{run,var}/log/journal/@{hex32}/user-@{hex}.journal* r,
    /{run,var}/log/journal/@{hex32}/system.journal* r,
    /{run,var}/log/journal/@{hex32}/system@@{hex}.journal* r,

    owner @{PROC}/@{pid}/stat r,

    include if exists <local/hw-probe_journalctl>
  }

  profile killall flags=(attach_disconnected) {
    include <abstractions/base>

    capability sys_ptrace,

    ptrace (read),

    signal (send) set=(int, term, kill),

    @{bin}/killall mr,

    @{PROC}/ r,
    @{PROC}/@{pids}/stat r,

    include if exists <local/hw-probe_killall>
  }

  profile udevadm flags=(attach_disconnected) {
    include <abstractions/base>
    include <abstractions/app/udevadm>

    include if exists <local/hw-probe_udevadm>
  }

  profile netconfig flags=(attach_disconnected) {
    include <abstractions/base>

    # Not needed
    deny capability net_admin,
    deny capability net_raw,

    network inet dgram,
    network inet6 dgram,
    network ipx dgram,
    network ax25 dgram,
    network appletalk dgram,
    network netlink raw,

    @{sbin}/iw       mr,
    @{sbin}/ifconfig mr,
    @{sbin}/iwconfig mr,
    @{sbin}/ethtool  mr,

    owner @{PROC}/@{pid}/net/if_inet6 r,
    owner @{PROC}/@{pid}/net/dev r,

    include if exists <local/hw-probe_netconfig>
  }

  profile systemctl flags=(attach_disconnected) {
    include <abstractions/base>
    include <abstractions/app/systemctl>

    include if exists <local/hw-probe_systemctl>
  }

  include if exists <local/hw-probe>
}

# vim:syntax=apparmor