54 lines
No EOL
1.3 KiB
Desktop File
54 lines
No EOL
1.3 KiB
Desktop File
# apparmor.d - Full set of apparmor profiles
|
|
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
|
|
# SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
# Profile for a systemd service, it does not specify an attachment path because
|
|
# it is intended to be used only via "Px -> *.service" exec transitions from systemd
|
|
|
|
abi <abi/3.0>,
|
|
|
|
include <tunables/global>
|
|
|
|
profile systemd.service @{exec_path} flags=(attach_disconnected) {
|
|
include <abstractions/base>
|
|
include <abstractions/consoles>
|
|
|
|
capability sys_admin,
|
|
|
|
@{bin}/{,ba,da}sh rm,
|
|
|
|
@{bin}/cp rix,
|
|
@{bin}/find rix,
|
|
@{bin}/grep rix,
|
|
@{bin}/install rix,
|
|
@{bin}/mkdir rix,
|
|
@{bin}/mount rix,
|
|
@{bin}/rm rix,
|
|
@{bin}/systemctl rix,
|
|
|
|
@{bin}/grub-editenv rPx,
|
|
@{bin}/ibus-daemon rPx,
|
|
|
|
@{bin}/chgrp rPx -> dmesg.service,
|
|
@{bin}/chmod rPx -> dmesg.service,
|
|
@{bin}/savelog rPx -> dmesg.service,
|
|
|
|
@{bin}/ldconfig rPx -> ldconfig.service,
|
|
|
|
@{lib}/ r,
|
|
|
|
/var/cache/ldconfig/aux-cache* rw,
|
|
|
|
# grub-common.service
|
|
/boot/grub/grubenv rw,
|
|
/boot/grub/ w,
|
|
|
|
# snapd.system-shutdown.service
|
|
@{run}/initramfs/shutdown rw,
|
|
@{run}/initramfs/ rw,
|
|
|
|
@{PROC}/cmdline r,
|
|
@{PROC}/sys/kernel/osrelease r,
|
|
|
|
include if exists <local/systemd.service>
|
|
} |