apparmor.d/profiles/abstractions/disks-read

# vim:syntax=apparmor
# ------------------------------------------------------------------
#
#    Copyright (C) 2019-2021 Mikhail Morfikov
#
#    This program is free software; you can redistribute it and/or
#    modify it under the terms of version 2 of the GNU General Public
#    License published by the Free Software Foundation.
#
# ------------------------------------------------------------------

  abi <abi/3.0>,

  # The /sys/ entries probably should be tightened

  /dev/ r,

  # Regular disk/partition devices
  /dev/sd[a-z] rk,
  /dev/sd[a-z][0-9]* rk,
  @{sys}/devices/pci[0-9]*/**/block/sd[a-z]/ r,
  @{sys}/devices/pci[0-9]*/**/block/sd[a-z]/** r,
  @{sys}/devices/pci[0-9]*/**/{usb,ata}[0-9]/** r,

  # SD card devices
  /dev/mmcblk[0-9]* rk,
  /dev/mmcblk[0-9]*p[0-9]* rk,
  @{sys}/devices/pci[0-9]*/**/block/mmcblk[0-9]*/ r,
  @{sys}/devices/pci[0-9]*/**/block/mmcblk[0-9]*/** r,
  @{sys}/devices/pci[0-9]*/**/mmc[0-9]*/mmc*/ r,
  @{sys}/devices/pci[0-9]*/**/mmc[0-9]*/mmc*/** r,

  # Loop devices
  /dev/loop[0-9]* rk,
  /dev/loop[0-9]*p[0-9]* rk,
  @{sys}/devices/virtual/block/loop[0-9]*/ r,
  @{sys}/devices/virtual/block/loop[0-9]*/** r,

  # LUKS/LVM (device-mapper) devices
  /dev/dm-[0-9]* rk,
  @{sys}/devices/virtual/block/dm-[0-9]*/ r,
  @{sys}/devices/virtual/block/dm-[0-9]*/** r,

  # ZRAM devices
  /dev/zram[0-9]* rk,
  @{sys}/devices/virtual/block/zram[0-9]*/ r,
  @{sys}/devices/virtual/block/zram[0-9]*/** r,

  # CD-ROM
  /dev/sr[0-9]* rk,

  @{sys}/class/block/ r,
  @{sys}/block/ r,
  # To be able to look up each block device by major:minor numbers
  @{sys}/dev/block/ r,

  # According to the kernel docs[1], the major block numbers from 240 to 254 are allocated
  # dynamically by the kernel for devices which don't have official numbers assigned. It looks like
  # that "dm" (device mapper) and "zram" are such devices. To avoid issues when kernel config
  # changes, it's better to allow the whole range (240-254) instead of the single major numbers
  # visible in the /proc/devices file.
  # [1]: https://raw.githubusercontent.com/torvalds/linux/master/Documentation/admin-guide/devices.txt
  @{run}/udev/data/b254:[0-9]* r, # for dynamic kernel assignment of block devices
  @{run}/udev/data/b253:[0-9]* r, # for dynamic kernel assignment of block devices
  @{run}/udev/data/b252:[0-9]* r, # for dynamic kernel assignment of block devices
  @{run}/udev/data/b251:[0-9]* r, # for dynamic kernel assignment of block devices
  @{run}/udev/data/b250:[0-9]* r, # for dynamic kernel assignment of block devices
  @{run}/udev/data/b249:[0-9]* r, # for dynamic kernel assignment of block devices
  @{run}/udev/data/b248:[0-9]* r, # for dynamic kernel assignment of block devices
  @{run}/udev/data/b247:[0-9]* r, # for dynamic kernel assignment of block devices
  @{run}/udev/data/b246:[0-9]* r, # for dynamic kernel assignment of block devices
  @{run}/udev/data/b245:[0-9]* r, # for dynamic kernel assignment of block devices
  @{run}/udev/data/b244:[0-9]* r, # for dynamic kernel assignment of block devices
  @{run}/udev/data/b243:[0-9]* r, # for dynamic kernel assignment of block devices
  @{run}/udev/data/b242:[0-9]* r, # for dynamic kernel assignment of block devices
  @{run}/udev/data/b241:[0-9]* r, # for dynamic kernel assignment of block devices
  @{run}/udev/data/b240:[0-9]* r, # for dynamic kernel assignment of block devices

  @{run}/udev/data/b179:[0-9]* r, # for /dev/mmcblk*
  @{run}/udev/data/b11:[0-9]*  r, # for /dev/sr*
  @{run}/udev/data/b8:[0-9]*   r, # for /dev/sd*
  @{run}/udev/data/b7:[0-9]*   r, # for /dev/loop*

  @{run}/udev/data/c189:[0-9]* r, # for /dev/bus/usb/**

  @{run}/udev/data/+usb:*      r, # for ?