146 lines
5.3 KiB
Text
146 lines
5.3 KiB
Text
# apparmor.d - Full set of apparmor profiles
|
|
# Copyright (C) 2019-2022 Mikhail Morfikov
|
|
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
|
# Copyright (C) 2022 Jeroen Rijken
|
|
# SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
abi <abi/4.0>,
|
|
|
|
include <tunables/global>
|
|
|
|
@{exec_path} = @{bin}/run-parts
|
|
profile run-parts @{exec_path} {
|
|
include <abstractions/base>
|
|
include <abstractions/consoles>
|
|
include <abstractions/nameservice-strict>
|
|
|
|
capability mknod,
|
|
|
|
@{exec_path} mrix,
|
|
|
|
@{sh_path} rix,
|
|
@{sbin}/anacron rix,
|
|
@{bin}/cat rix,
|
|
@{bin}/date rix,
|
|
@{bin}/nice rix,
|
|
@{bin}/snapper rix,
|
|
|
|
/usr/share/update-notifier/notify-reboot-required rPx,
|
|
/usr/share/update-notifier/notify-updates-outdated rPx,
|
|
|
|
/etc/ r,
|
|
/etc/anacrontab r,
|
|
/etc/conf.d/snapper{,**} r,
|
|
/etc/default/* r,
|
|
/etc/profile.d/{,**} r,
|
|
/etc/snapper/configs/root r,
|
|
|
|
# Crontab
|
|
/etc/cron.{hourly,daily,weekly,monthly}/ r,
|
|
/etc/cron.{hourly,daily,weekly,monthly}/0anacron rix,
|
|
/etc/cron.{hourly,daily,weekly,monthly}/apport rPx,
|
|
/etc/cron.{hourly,daily,weekly,monthly}/apt-compat rPx,
|
|
/etc/cron.{hourly,daily,weekly,monthly}/apt-listbugs rPx,
|
|
/etc/cron.{hourly,daily,weekly,monthly}/apt-show-versions rPx,
|
|
/etc/cron.{hourly,daily,weekly,monthly}/apt-xapian-index rPx,
|
|
/etc/cron.{hourly,daily,weekly,monthly}/aptitude rPx,
|
|
/etc/cron.{hourly,daily,weekly,monthly}/bsdmainutils rPUx,
|
|
/etc/cron.{hourly,daily,weekly,monthly}/checksecurity rPUx,
|
|
/etc/cron.{hourly,daily,weekly,monthly}/debsums rPx,
|
|
/etc/cron.{hourly,daily,weekly,monthly}/debtags rPx,
|
|
/etc/cron.{hourly,daily,weekly,monthly}/dlocate rPx,
|
|
/etc/cron.{hourly,daily,weekly,monthly}/dpkg rPUx,
|
|
/etc/cron.{hourly,daily,weekly,monthly}/etckeeper rPx,
|
|
/etc/cron.{hourly,daily,weekly,monthly}/exim4-base rPx,
|
|
/etc/cron.{hourly,daily,weekly,monthly}/logrotate rPx,
|
|
/etc/cron.{hourly,daily,weekly,monthly}/man-db rPx,
|
|
/etc/cron.{hourly,daily,weekly,monthly}/mlocate rPx,
|
|
/etc/cron.{hourly,daily,weekly,monthly}/passwd rPUx,
|
|
/etc/cron.{hourly,daily,weekly,monthly}/plocate rPx,
|
|
/etc/cron.{hourly,daily,weekly,monthly}/popularity-contest rPx,
|
|
/etc/cron.{hourly,daily,weekly,monthly}/snapper rPUx,
|
|
/etc/cron.{hourly,daily,weekly,monthly}/spamassassin rPUx,
|
|
/etc/cron.{hourly,daily,weekly,monthly}/sysstat rPx,
|
|
/etc/cron.{hourly,daily,weekly,monthly}/tor rPUx,
|
|
/etc/cron.{hourly,daily,weekly,monthly}/vrms rPUx,
|
|
/var/spool/anacron/cron.{hourly,daily,weekly,monthly} rw,
|
|
|
|
# Network
|
|
/etc/network/if-down.d/ r,
|
|
/etc/network/if-down.d/openvpn rPUx,
|
|
/etc/network/if-down.d/resolvconf rPUx,
|
|
/etc/network/if-down.d/wpasupplicant rPUx,
|
|
|
|
/etc/hostapd/ifupdown.sh rPUx,
|
|
/etc/macchanger/ifupdown.sh rPUx,
|
|
/etc/wpa_supplicant/ifupdown.sh rPUx,
|
|
|
|
/etc/network/if-post-down.d/ r,
|
|
/etc/network/if-post-down.d/bridge rPUx,
|
|
/etc/network/if-post-down.d/chrony rPUx,
|
|
/etc/network/if-post-down.d/hostapd rPUx,
|
|
/etc/network/if-post-down.d/ifenslave rPUx,
|
|
/etc/network/if-post-down.d/macchanger rPUx,
|
|
/etc/network/if-post-down.d/wireless-tools rPUx,
|
|
/etc/network/if-post-down.d/wpasupplicant rPUx,
|
|
|
|
/etc/network/if-pre-up.d/ r,
|
|
/etc/network/if-pre-up.d/bridge rPUx,
|
|
/etc/network/if-pre-up.d/ethtool rPUx,
|
|
/etc/network/if-pre-up.d/hostapd rPUx,
|
|
/etc/network/if-pre-up.d/ifenslave rPUx,
|
|
/etc/network/if-pre-up.d/macchanger rPUx,
|
|
/etc/network/if-pre-up.d/random-secret rPUx,
|
|
/etc/network/if-pre-up.d/wireless-tools rPUx,
|
|
/etc/network/if-pre-up.d/wpasupplicant rPUx,
|
|
|
|
/etc/network/if-up.d/ r,
|
|
/etc/network/if-up.d/*resolvconf rPUx,
|
|
/etc/network/if-up.d/avahi-autoipd rPUx,
|
|
/etc/network/if-up.d/chrony rPUx,
|
|
/etc/network/if-up.d/ethtool rPUx,
|
|
/etc/network/if-up.d/ifenslave rPUx,
|
|
/etc/network/if-up.d/openvpn rPUx,
|
|
/etc/network/if-up.d/postfix rPUx,
|
|
/etc/network/if-up.d/ubuntu-fan rPx,
|
|
/etc/network/if-up.d/wpasupplicant rPUx,
|
|
|
|
# Motd
|
|
/etc/update-motd.d/ r,
|
|
/etc/update-motd.d/* rPx,
|
|
|
|
# Kernel
|
|
/etc/kernel/{,header_}postinst.d/ r,
|
|
/etc/kernel/{,header_}postinst.d/* rPx,
|
|
/etc/kernel/postrm.d/ r,
|
|
/etc/kernel/postrm.d/* rPx,
|
|
/etc/kernel/preinst.d/ r,
|
|
/etc/kernel/preinst.d/* rPx,
|
|
/etc/kernel/prerm.d/ r,
|
|
/etc/kernel/prerm.d/* rPx,
|
|
|
|
# Finalrd
|
|
/usr/share/finalrd/ r,
|
|
/usr/share/finalrd/mdadm.finalrd rPUx,
|
|
/usr/share/finalrd/open-iscsi.finalrd rPUx,
|
|
|
|
/usr/share/landscape/landscape-sysinfo.wrapper rPx,
|
|
|
|
/root/ r,
|
|
|
|
/var/spool/anacron/cron.daily k,
|
|
|
|
owner @{tmp}/#@{int} rw,
|
|
owner @{tmp}/$anacron@{rand6} rw,
|
|
owner @{tmp}/file@{rand6} rw,
|
|
|
|
owner @{sys}/class/power_supply/ r,
|
|
|
|
@{run}/motd.dynamic.new w,
|
|
|
|
/dev/tty@{int} rw,
|
|
|
|
include if exists <local/run-parts>
|
|
}
|
|
|
|
# vim:syntax=apparmor
|