40a30dc310
Move vim syntax comment to the end of the file, separated by newline, as requested in #380.
78 lines
1.9 KiB
Text
78 lines
1.9 KiB
Text
# apparmor.d - Full set of apparmor profiles
|
|
# Copyright (C) 2019-2021 Mikhail Morfikov
|
|
# Copyright (C) 2021-2024 Alexandre Pujol <alexandre@pujol.io>
|
|
# SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
abi <abi/3.0>,
|
|
|
|
include <tunables/global>
|
|
|
|
@{exec_path} = @{bin}/repo
|
|
profile repo @{exec_path} {
|
|
include <abstractions/base>
|
|
include <abstractions/python>
|
|
include <abstractions/nameservice-strict>
|
|
include <abstractions/ssl_certs>
|
|
|
|
network inet dgram,
|
|
network inet6 dgram,
|
|
network inet stream,
|
|
network inet6 stream,
|
|
network netlink raw,
|
|
|
|
@{exec_path} r,
|
|
|
|
@{sh_path} rix,
|
|
@{bin}/ r,
|
|
@{bin}/curl rix,
|
|
@{bin}/env rix,
|
|
@{bin}/git rix,
|
|
@{bin}/python3.@{int} rix,
|
|
@{bin}/uname rix,
|
|
@{lib}/git{,-core}/git* rix,
|
|
|
|
@{bin}/gpg{,2} rCx -> gpg,
|
|
@{bin}/ssh rPx,
|
|
|
|
/usr/share/git-core/{,**} r,
|
|
|
|
# Android source dir
|
|
owner @{user_projects_dirs}/** rwkl -> @{user_projects_dirs}/**,
|
|
owner @{user_projects_dirs}/**/.repo/repo/main.py rix,
|
|
|
|
owner @{HOME}/.gitconfig rw,
|
|
owner @{HOME}/.gitconfig.lock rwk,
|
|
owner @{HOME}/.repo_.gitconfig.json rw,
|
|
owner @{HOME}/.repoconfig/{,**} rw,
|
|
|
|
owner @{user_config_dirs}/git/config rw,
|
|
|
|
owner @{tmp}/.git_vtag_tmp@{rand6} rw,
|
|
owner @{tmp}/ssh-*/ rw,
|
|
|
|
owner /dev/shm/* rw,
|
|
owner /dev/shm/sem.mp-???????? rwl -> /dev/shm/*, # unconventional '_' tail
|
|
|
|
owner @{PROC}/@{pid}/fd/ r,
|
|
owner @{PROC}/@{pid}/mounts r,
|
|
|
|
# Silencer
|
|
deny /etc/.repo_gitconfig.json w,
|
|
|
|
profile gpg {
|
|
include <abstractions/base>
|
|
|
|
@{bin}/gpg{,2} mr,
|
|
|
|
owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**,
|
|
owner @{HOME}/.repoconfig/gnupg/** rwkl -> @{HOME}/.repoconfig/gnupg/**,
|
|
|
|
owner @{tmp}/.git_vtag_tmp@{rand6} r,
|
|
|
|
include if exists <local/repo_gpg>
|
|
}
|
|
|
|
include if exists <local/repo>
|
|
}
|
|
|
|
# vim:syntax=apparmor
|