07f3ea979a
Move vim syntax comment to the end of the file, separated by newline, as requested in #380.
69 lines
1.4 KiB
Text
69 lines
1.4 KiB
Text
# apparmor.d - Full set of apparmor profiles
|
|
# Copyright (C) 2019-2021 Mikhail Morfikov
|
|
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
|
# SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
abi <abi/3.0>,
|
|
|
|
include <tunables/global>
|
|
|
|
@{exec_path} = @{bin}/kernel-install
|
|
profile kernel-install @{exec_path} {
|
|
include <abstractions/base>
|
|
include <abstractions/consoles>
|
|
include <abstractions/nameservice-strict>
|
|
|
|
@{exec_path} r,
|
|
@{sh_path} rix,
|
|
|
|
@{bin}/mountpoint rix,
|
|
@{bin}/sort rix,
|
|
@{bin}/rm rix,
|
|
@{bin}/mkdir rix,
|
|
@{bin}/cp rix,
|
|
@{bin}/chown rix,
|
|
@{bin}/chmod rix,
|
|
@{bin}/basename rix,
|
|
|
|
@{bin}/kmod rCx -> kmod,
|
|
|
|
@{lib}/kernel/install.d/ r,
|
|
@{lib}/kernel/install.d/@{int2}-*.install rix,
|
|
|
|
/etc/kernel/install.d/ r,
|
|
/etc/kernel/install.d/*.install rix,
|
|
|
|
owner @{tmp}/sh-thd.* rw,
|
|
|
|
owner /boot/{vmlinuz,initrd.img}-* r,
|
|
owner /boot/[a-f0-9]*/*/ rw,
|
|
owner /boot/[a-f0-9]*/*/{linux,initrd} w,
|
|
owner /boot/loader/ rw,
|
|
owner /boot/loader/entries/ rw,
|
|
owner /boot/loader/entries/*.conf w,
|
|
|
|
@{lib}/modules/*/modules.* w,
|
|
|
|
/etc/os-release r,
|
|
@{lib}/os-release r,
|
|
|
|
/etc/kernel/tries r,
|
|
|
|
/etc/kernel/cmdline r,
|
|
@{PROC}/cmdline r,
|
|
|
|
/var/lib/dbus/machine-id r,
|
|
/etc/machine-id r,
|
|
|
|
|
|
profile kmod flags=(complain) {
|
|
include <abstractions/base>
|
|
|
|
@{bin}/kmod mr,
|
|
|
|
}
|
|
|
|
include if exists <local/kernel-install>
|
|
}
|
|
|
|
# vim:syntax=apparmor
|