52 lines
1.2 KiB
Text
52 lines
1.2 KiB
Text
# apparmor.d - Full set of apparmor profiles
|
|
# Copyright (C) 2019-2021 Mikhail Morfikov
|
|
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
|
# SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
abi <abi/4.0>,
|
|
|
|
include <tunables/global>
|
|
|
|
@{exec_path} = @{bin}/unmkinitramfs
|
|
profile unmkinitramfs @{exec_path} {
|
|
include <abstractions/base>
|
|
|
|
# To avoid the following error:
|
|
# cpio: etc/console-setup/null: Cannot mknod: Operation not permitted
|
|
capability mknod,
|
|
|
|
@{exec_path} r,
|
|
|
|
@{sh_path} rix,
|
|
@{archive_path} rix,
|
|
@{bin}/{,e}grep rix,
|
|
@{bin}/cat rix,
|
|
@{bin}/dd rix,
|
|
@{bin}/getopt rix,
|
|
@{bin}/lz4cat rix,
|
|
@{bin}/lzma rix,
|
|
@{bin}/lzop rix,
|
|
@{bin}/mkdir rix,
|
|
@{bin}/mktemp rix,
|
|
@{bin}/rm rix,
|
|
@{bin}/xzcat rix,
|
|
|
|
@{efi}/ r,
|
|
owner @{efi}/initrd.img-* r,
|
|
/tmp/ r,
|
|
owner @{tmp}/initrd.img-* r,
|
|
/mnt/ r,
|
|
owner /mnt/initrd.img-* r,
|
|
/mnt/boot/ r,
|
|
owner /mnt/boot/initrd.img-* r,
|
|
|
|
# To extract the content of the initrd image
|
|
owner @{tmp}/** rwl -> /tmp/**,
|
|
|
|
/var/tmp/ r,
|
|
owner /var/tmp/unmkinitramfs_* rw,
|
|
|
|
include if exists <local/unmkinitramfs>
|
|
}
|
|
|
|
# vim:syntax=apparmor
|