2020-09-12 17:19:23 +02:00
|
|
|
# vim:syntax=apparmor
|
|
|
|
# ------------------------------------------------------------------
|
|
|
|
#
|
2021-01-10 16:35:07 +01:00
|
|
|
# Copyright (C) 2019-2021 Mikhail Morfikov
|
2020-09-12 17:19:23 +02:00
|
|
|
#
|
|
|
|
# This program is free software; you can redistribute it and/or
|
|
|
|
# modify it under the terms of version 2 of the GNU General Public
|
|
|
|
# License published by the Free Software Foundation.
|
|
|
|
#
|
|
|
|
# ------------------------------------------------------------------
|
|
|
|
|
2020-12-10 22:33:39 +01:00
|
|
|
abi <abi/3.0>,
|
2020-09-12 17:19:23 +02:00
|
|
|
|
2020-12-10 22:33:39 +01:00
|
|
|
include <tunables/global>
|
2020-09-12 17:19:23 +02:00
|
|
|
|
|
|
|
@{exec_path} = /{usr/,}bin/hw-probe
|
|
|
|
profile hw-probe @{exec_path} {
|
2020-12-10 22:33:39 +01:00
|
|
|
include <abstractions/base>
|
|
|
|
include <abstractions/perl>
|
2020-09-12 17:19:23 +02:00
|
|
|
|
|
|
|
capability sys_admin,
|
|
|
|
|
2020-12-10 22:33:39 +01:00
|
|
|
network inet dgram,
|
|
|
|
network inet6 dgram,
|
|
|
|
|
2020-09-12 17:19:23 +02:00
|
|
|
@{exec_path} r,
|
|
|
|
/{usr/,}bin/perl r,
|
|
|
|
|
|
|
|
/{usr/,}bin/pwd rix,
|
|
|
|
/{usr/,}bin/{,e}grep rix,
|
2020-12-09 10:30:52 +01:00
|
|
|
/{usr/,}bin/{,ba,da}sh rix,
|
2020-09-12 17:19:23 +02:00
|
|
|
/{usr/,}bin/gawk rix,
|
|
|
|
/{usr/,}bin/sleep rix,
|
|
|
|
/{usr/,}bin/md5sum rix,
|
|
|
|
/{usr/,}bin/uname rix,
|
|
|
|
|
|
|
|
/{usr/,}bin/dd rix,
|
2020-12-10 22:33:39 +01:00
|
|
|
/{usr/,}bin/tar rix,
|
2020-09-12 17:19:23 +02:00
|
|
|
|
|
|
|
/{usr/,}bin/efivar rix,
|
|
|
|
/{usr/,}bin/efibootmgr rix,
|
|
|
|
|
|
|
|
/{usr/,}bin/lsb_release rPx -> child-lsb_release,
|
|
|
|
/{usr/,}bin/dpkg rPx -> child-dpkg,
|
|
|
|
|
|
|
|
/{usr/,}sbin/dkms rPx,
|
|
|
|
/{usr/,}sbin/fdisk rPx,
|
|
|
|
/{usr/,}bin/upower rPx,
|
|
|
|
/{usr/,}sbin/hdparm rPx,
|
|
|
|
/{usr/,}sbin/smartctl rPx,
|
|
|
|
/{usr/,}bin/sensors rPx,
|
|
|
|
/{usr/,}bin/lsblk rPx,
|
|
|
|
/{usr/,}bin/dmesg rPx,
|
|
|
|
/{usr/,}bin/hciconfig rPx,
|
|
|
|
/{usr/,}bin/uptime rPx,
|
|
|
|
/{usr/,}sbin/rfkill rPx,
|
|
|
|
/{usr/,}sbin/biosdecode rPx,
|
|
|
|
/{usr/,}sbin/dmidecode rPx,
|
|
|
|
/{usr/,}bin/edid-decode rPx,
|
|
|
|
/{usr/,}bin/cpupower rPx,
|
|
|
|
/{usr/,}bin/acpi rPx,
|
|
|
|
/{usr/,}bin/lspci rPx,
|
|
|
|
/{usr/,}bin/lscpu rPx,
|
|
|
|
/{usr/,}bin/lsusb rPx,
|
|
|
|
/{usr/,}bin/usb-devices rPx,
|
|
|
|
/{usr/,}sbin/hwinfo rPx,
|
|
|
|
/{usr/,}bin/glxinfo rPx,
|
|
|
|
/{usr/,}sbin/i2cdetect rPx,
|
|
|
|
/{usr/,}bin/glxgears rPx,
|
|
|
|
/{usr/,}sbin/memtester rPx,
|
|
|
|
/{usr/,}bin/xrandr rPx,
|
|
|
|
/{usr/,}bin/inxi rPx,
|
|
|
|
/{usr/,}bin/aplay rPx,
|
|
|
|
/{usr/,}bin/amixer rPx,
|
|
|
|
/{usr/,}bin/xdpyinfo rPx,
|
|
|
|
/{usr/,}bin/df rPx,
|
|
|
|
/{usr/,}bin/cpuid rPx,
|
|
|
|
/{usr/,}bin/xinput rPx,
|
|
|
|
|
|
|
|
/{usr/,}bin/systemctl rPx -> child-systemctl,
|
|
|
|
|
|
|
|
/{usr/,}bin/find rCx -> find,
|
|
|
|
/{usr/,}bin/journalctl rCx -> journalctl,
|
|
|
|
/{usr/,}bin/systemd-analyze rCx -> systemd-analyze,
|
|
|
|
/{usr/,}bin/killall rCx -> killall,
|
|
|
|
/{usr/,}bin/udevadm rCx -> udevadm,
|
|
|
|
/{usr/,}bin/kmod rCx -> kmod,
|
|
|
|
/{usr/,}sbin/iw rCx -> netconfig,
|
|
|
|
/{usr/,}sbin/ifconfig rCx -> netconfig,
|
|
|
|
/{usr/,}sbin/iwconfig rCx -> netconfig,
|
|
|
|
/{usr/,}sbin/ethtool rCx -> netconfig,
|
2020-12-10 22:33:39 +01:00
|
|
|
/{usr/,}bin/curl rCx -> curl,
|
2020-09-12 17:19:23 +02:00
|
|
|
|
|
|
|
owner /root/HW_PROBE/{,**} rw,
|
|
|
|
|
|
|
|
owner /tmp/*/ rw,
|
|
|
|
owner /tmp/*/cpu_perf rw,
|
|
|
|
|
|
|
|
/var/log/Xorg.[0-9].log{,.old} r,
|
|
|
|
/etc/X11/xorg.conf.d/{,*.conf} r,
|
|
|
|
/usr/share/X11/xorg.conf.d/{,*.conf} r,
|
|
|
|
|
|
|
|
/etc/modprobe.d/{,*.conf} r,
|
|
|
|
|
|
|
|
@{sys}/class/drm/ r,
|
|
|
|
@{sys}/class/power_supply/ r,
|
|
|
|
|
|
|
|
@{sys}/devices/virtual/dmi/id/* r,
|
|
|
|
@{sys}/devices/pci[0-9]*/**/drm/card[0-9]/*/edid r,
|
|
|
|
@{sys}/devices/**/power_supply/*/uevent r,
|
|
|
|
|
|
|
|
@{sys}/firmware/efi/efivars/ r,
|
|
|
|
@{sys}/firmware/efi/efivars/* r,
|
|
|
|
|
|
|
|
@{PROC}/scsi/scsi r,
|
|
|
|
@{PROC}/ioports r,
|
|
|
|
@{PROC}/interrupts r,
|
|
|
|
@{PROC}/bus/input/devices r,
|
|
|
|
|
|
|
|
|
|
|
|
profile find {
|
2020-12-10 22:33:39 +01:00
|
|
|
include <abstractions/base>
|
|
|
|
include <abstractions/nameservice-strict>
|
2020-09-12 17:19:23 +02:00
|
|
|
|
|
|
|
capability dac_read_search,
|
|
|
|
|
|
|
|
/{usr/,}bin/find mr,
|
|
|
|
|
|
|
|
/dev/{,**} r,
|
|
|
|
|
2020-12-10 22:33:39 +01:00
|
|
|
/root/ r,
|
|
|
|
|
2020-09-12 17:19:23 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
profile journalctl {
|
2020-12-10 22:33:39 +01:00
|
|
|
include <abstractions/base>
|
2020-09-12 17:19:23 +02:00
|
|
|
|
|
|
|
/{usr/,}bin/journalctl mr,
|
|
|
|
|
2020-10-25 10:23:34 +01:00
|
|
|
@{run}/log/ rw,
|
2020-09-12 17:19:23 +02:00
|
|
|
/{run,var}/log/journal/ rw,
|
|
|
|
/{run,var}/log/journal/[0-9a-f]*/ rw,
|
|
|
|
/{run,var}/log/journal/[0-9a-f]*/user-[0-9a-f]*.journal* rw,
|
|
|
|
/{run,var}/log/journal/[0-9a-f]*/system.journal* rw,
|
|
|
|
/{run,var}/log/journal/[0-9a-f]*/system@[0-9a-f]*.journal* rw,
|
|
|
|
|
|
|
|
owner @{PROC}/@{pid}/stat r,
|
|
|
|
|
|
|
|
/var/lib/dbus/machine-id r,
|
|
|
|
/etc/machine-id r,
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
profile systemd-analyze {
|
2020-12-10 22:33:39 +01:00
|
|
|
include <abstractions/base>
|
2020-09-12 17:19:23 +02:00
|
|
|
|
|
|
|
/{usr/,}bin/systemd-analyze mr,
|
|
|
|
|
|
|
|
owner @{PROC}/@{pid}/stat r,
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
profile killall {
|
2020-12-10 22:33:39 +01:00
|
|
|
include <abstractions/base>
|
2020-09-12 17:19:23 +02:00
|
|
|
|
|
|
|
capability sys_ptrace,
|
|
|
|
|
|
|
|
signal (send) set=(int, term, kill),
|
|
|
|
|
|
|
|
ptrace (read),
|
|
|
|
|
|
|
|
/{usr/,}bin/killall mr,
|
|
|
|
|
|
|
|
# The /proc/ dir is needed to avoid the following error:
|
|
|
|
# /proc: Permission denied
|
|
|
|
@{PROC}/ r,
|
|
|
|
@{PROC}/@{pids}/stat r,
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
profile udevadm {
|
2020-12-10 22:33:39 +01:00
|
|
|
include <abstractions/base>
|
2020-09-12 17:19:23 +02:00
|
|
|
|
|
|
|
/{usr/,}bin/udevadm mr,
|
|
|
|
|
|
|
|
/etc/udev/udev.conf r,
|
|
|
|
|
|
|
|
owner @{PROC}/@{pid}/stat r,
|
|
|
|
@{PROC}/cmdline r,
|
|
|
|
@{PROC}/1/sched r,
|
|
|
|
@{PROC}/1/environ r,
|
|
|
|
@{PROC}/sys/kernel/osrelease r,
|
|
|
|
|
|
|
|
@{sys}/bus/ r,
|
|
|
|
@{sys}/bus/*/devices/ r,
|
|
|
|
@{sys}/class/ r,
|
|
|
|
@{sys}/class/*/ r,
|
|
|
|
@{sys}/devices/**/uevent r,
|
2020-10-25 10:23:34 +01:00
|
|
|
@{run}/udev/data/* r,
|
2020-09-12 17:19:23 +02:00
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
profile kmod {
|
2020-12-10 22:33:39 +01:00
|
|
|
include <abstractions/base>
|
2020-09-12 17:19:23 +02:00
|
|
|
|
|
|
|
/{usr/,}bin/kmod mr,
|
|
|
|
|
|
|
|
@{PROC}/cmdline r,
|
|
|
|
@{PROC}/modules r,
|
|
|
|
|
|
|
|
@{sys}/module/*/ r,
|
|
|
|
@{sys}/module/*/{coresize,refcnt} r,
|
|
|
|
@{sys}/module/*/holders/ r,
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
profile netconfig {
|
2020-12-10 22:33:39 +01:00
|
|
|
include <abstractions/base>
|
2020-09-12 17:19:23 +02:00
|
|
|
|
|
|
|
# Not needed
|
|
|
|
deny capability net_admin,
|
|
|
|
deny capability net_raw,
|
|
|
|
|
2020-12-10 22:33:39 +01:00
|
|
|
network inet dgram,
|
|
|
|
network inet6 dgram,
|
|
|
|
network ipx dgram,
|
|
|
|
network ax25 dgram,
|
|
|
|
network appletalk dgram,
|
|
|
|
network netlink raw,
|
|
|
|
|
2020-09-12 17:19:23 +02:00
|
|
|
/{usr/,}sbin/iw mr,
|
|
|
|
/{usr/,}sbin/ifconfig mr,
|
|
|
|
/{usr/,}sbin/iwconfig mr,
|
|
|
|
/{usr/,}sbin/ethtool mr,
|
|
|
|
|
|
|
|
owner @{PROC}/@{pid}/net/if_inet6 r,
|
|
|
|
owner @{PROC}/@{pid}/net/dev r,
|
|
|
|
|
|
|
|
}
|
|
|
|
|
2020-12-10 22:33:39 +01:00
|
|
|
profile curl {
|
|
|
|
include <abstractions/base>
|
|
|
|
include <abstractions/nameservice-strict>
|
|
|
|
include <abstractions/openssl>
|
|
|
|
include <abstractions/ssl_certs>
|
|
|
|
|
|
|
|
/{usr/,}bin/curl mr,
|
|
|
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
include if exists <local/hw-probe>
|
2020-09-12 17:19:23 +02:00
|
|
|
}
|