66 lines
1.3 KiB
Text
66 lines
1.3 KiB
Text
# apparmor.d - Full set of apparmor profiles
|
|
# Copyright (C) 2019-2021 Mikhail Morfikov
|
|
# SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
abi <abi/3.0>,
|
|
|
|
include <tunables/global>
|
|
|
|
@{exec_path} = @{bin}/kernel-install
|
|
profile kernel-install @{exec_path} {
|
|
include <abstractions/base>
|
|
include <abstractions/consoles>
|
|
include <abstractions/nameservice-strict>
|
|
|
|
@{exec_path} r,
|
|
@{bin}/{,ba,da}sh rix,
|
|
|
|
@{bin}/mountpoint rix,
|
|
@{bin}/sort rix,
|
|
@{bin}/rm rix,
|
|
@{bin}/mkdir rix,
|
|
@{bin}/cp rix,
|
|
@{bin}/chown rix,
|
|
@{bin}/chmod rix,
|
|
@{bin}/basename rix,
|
|
|
|
@{bin}/kmod rCx -> kmod,
|
|
|
|
@{lib}/kernel/install.d/ r,
|
|
@{lib}/kernel/install.d/[0-9][0-9]-*.install rix,
|
|
|
|
/etc/kernel/install.d/ r,
|
|
/etc/kernel/install.d/*.install rix,
|
|
|
|
owner /tmp/sh-thd.* rw,
|
|
|
|
owner /boot/{vmlinuz,initrd.img}-* r,
|
|
owner /boot/[a-f0-9]*/*/ rw,
|
|
owner /boot/[a-f0-9]*/*/{linux,initrd} w,
|
|
owner /boot/loader/ rw,
|
|
owner /boot/loader/entries/ rw,
|
|
owner /boot/loader/entries/*.conf w,
|
|
|
|
@{lib}/modules/*/modules.* w,
|
|
|
|
/etc/os-release r,
|
|
@{lib}/os-release r,
|
|
|
|
/etc/kernel/tries r,
|
|
|
|
/etc/kernel/cmdline r,
|
|
@{PROC}/cmdline r,
|
|
|
|
/var/lib/dbus/machine-id r,
|
|
/etc/machine-id r,
|
|
|
|
|
|
profile kmod flags=(complain) {
|
|
include <abstractions/base>
|
|
|
|
@{bin}/kmod mr,
|
|
|
|
}
|
|
|
|
include if exists <local/kernel-install>
|
|
}
|