mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-18 00:48:10 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(abs): add udevadm app abstraction.

Browse source
This commit is contained in:
Alexandre Pujol 2024-06-15 16:40:11 +01:00
parent 39bfa9a40b
commit 035e1da7b2
Failed to generate hash of commit
14 changed files with 51 additions and 178 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

26
apparmor.d/abstractions/app/udevadm Normal file
View file

@ -0,0 +1,26 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
ptrace read peer=@{p_systemd},
@{bin}/udevadm mr,
/etc/udev/udev.conf r,
@{run}/udev/data/* r,
@{sys}/** r,
@{PROC}/1/cgroup r,
@{PROC}/1/environ r,
@{PROC}/1/sched r,
@{PROC}/cmdline r,
@{PROC}/sys/kernel/osrelease r,
@{PROC}/sys/kernel/random/boot_id r,
owner @{PROC}/@{pid}/cgroup r,
owner @{PROC}/@{pid}/stat r,
include if exists <abstractions/app/udevadm.d>
# vim:syntax=apparmor

13
apparmor.d/groups/display-manager/x11-xsession
View file

@ -139,18 +139,7 @@ profile x11-xsession @{exec_path} {
profile udevadm { profile udevadm {
include <abstractions/base> include <abstractions/base>
include <abstractions/common/systemd> include <abstractions/app/udevadm>
@{bin}/udevadm mr,
/etc/udev/udev.conf r,
@{sys}/bus/ r,
@{sys}/bus/*/devices/ r,
@{sys}/class/ r,
@{sys}/class/*/ r,
@{sys}/devices/**/uevent r,
@{run}/udev/data/* r,
include if exists <local/x11-xsession_udevadm> include if exists <local/x11-xsession_udevadm>
} }

6
apparmor.d/groups/network/netplan.script
View file

@ -34,11 +34,7 @@ profile netplan.script @{exec_path} flags=(attach_disconnected) {
profile udevadm { profile udevadm {
include <abstractions/base> include <abstractions/base>
include <abstractions/common/systemd> include <abstractions/app/udevadm>
@{bin}/udevadm mr,
/etc/udev/udev.conf r,
@{run}/udev/control rw, @{run}/udev/control rw,
@{run}/udev/rules.d/90-netplan.rules rw, @{run}/udev/rules.d/90-netplan.rules rw,

22
apparmor.d/profiles-a-f/f3fix
View file

@ -37,26 +37,12 @@ profile f3fix @{exec_path} {
profile udevadm { profile udevadm {
include <abstractions/base> include <abstractions/base>
include <abstractions/app/udevadm>
include <abstractions/disks-write>
ptrace (read), ptrace read,
@{bin}/udevadm mr,
/etc/udev/udev.conf r,
owner @{PROC}/@{pid}/stat r,
owner @{PROC}/@{pid}/cgroup r,
@{PROC}/cmdline r,
@{PROC}/1/sched r,
@{PROC}/1/environ r,
@{PROC}/sys/kernel/osrelease r,
@{PROC}/sys/kernel/random/boot_id r,
@{sys}/firmware/efi/efivars/SecureBoot-@{uuid} r,
# file_inherit
/dev/sd[a-z]* rw,
include if exists <local/f3fix_udevadm>
} }
include if exists <local/f3fix> include if exists <local/f3fix>

22
apparmor.d/profiles-a-f/fatresize
View file

@ -36,26 +36,10 @@ profile fatresize @{exec_path} {
profile udevadm { profile udevadm {
include <abstractions/base> include <abstractions/base>
include <abstractions/app/udevadm>
include <abstractions/disks-write>
ptrace (read), include if exists <local/fatresize_udevadm>
@{bin}/udevadm mr,
/etc/udev/udev.conf r,
owner @{PROC}/@{pid}/stat r,
owner @{PROC}/@{pid}/cgroup r,
@{PROC}/cmdline r,
@{PROC}/1/sched r,
@{PROC}/1/environ r,
@{PROC}/sys/kernel/osrelease r,
@{PROC}/sys/kernel/random/boot_id r,
@{sys}/firmware/efi/efivars/SecureBoot-@{uuid} r,
# file_inherit
/dev/{s,v}d[a-z]* rw,
} }
include if exists <local/fatresize> include if exists <local/fatresize>

8
apparmor.d/profiles-g-l/gparted
View file

@ -60,16 +60,10 @@ profile gparted @{exec_path} {
profile udevadm { profile udevadm {
include <abstractions/base> include <abstractions/base>
include <abstractions/common/systemd> include <abstractions/app/udevadm>
@{bin}/udevadm mr,
/etc/udev/udev.conf r,
@{sys}/** r,
@{sys}/devices/virtual/block/**/uevent rw, @{sys}/devices/virtual/block/**/uevent rw,
@{sys}/devices/@{pci}/block/**/uevent rw, @{sys}/devices/@{pci}/block/**/uevent rw,
@{run}/udev/data/* r,
include if exists <local/gparted_udevadm> include if exists <local/gparted_udevadm>
} }

18
apparmor.d/profiles-g-l/gpartedbin
View file

@ -132,24 +132,10 @@ profile gpartedbin @{exec_path} {
profile udevadm { profile udevadm {
include <abstractions/base> include <abstractions/base>
include <abstractions/app/udevadm>
include <abstractions/disks-write> include <abstractions/disks-write>
ptrace (read), include if exists <local/gpartedbin_udevadm>
@{bin}/udevadm mr,
/etc/udev/udev.conf r,
@{PROC}/1/environ r,
@{PROC}/1/sched r,
@{PROC}/cmdline r,
@{PROC}/sys/kernel/osrelease r,
@{PROC}/sys/kernel/random/boot_id r,
owner @{PROC}/@{pid}/cgroup r,
owner @{PROC}/@{pid}/stat r,
/dev/mapper/control rw,
} }
include if exists <local/gpartedbin> include if exists <local/gpartedbin>

14
apparmor.d/profiles-g-l/hw-probe
View file

@ -163,19 +163,9 @@ profile hw-probe @{exec_path} {
include if exists <local/hw-probe_killall> include if exists <local/hw-probe_killall>
} }
profile udevadm { profile udevadm flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/common/systemd> include <abstractions/app/udevadm>
@{bin}/udevadm mr,
/etc/udev/udev.conf r,
@{sys}/bus/ r,
@{sys}/bus/*/devices/ r,
@{sys}/class/ r,
@{sys}/class/*/ r,
@{sys}/devices/**/uevent r,
include if exists <local/hw-probe_udevadm> include if exists <local/hw-probe_udevadm>
} }

16
apparmor.d/profiles-g-l/hwinfo
View file

@ -92,23 +92,11 @@ profile hwinfo @{exec_path} {
profile udevadm { profile udevadm {
include <abstractions/base> include <abstractions/base>
include <abstractions/app/udevadm>
@{bin}/udevadm mr,
/etc/udev/udev.conf r,
owner @{PROC}/@{pid}/stat r,
@{PROC}/cmdline r,
@{PROC}/1/sched r,
@{PROC}/1/environ r,
@{PROC}/sys/kernel/osrelease r,
@{sys}/** r,
@{run}/udev/data/* r,
# file_inherit
owner @{tmp}/hwinfo*.txt rw, owner @{tmp}/hwinfo*.txt rw,
include if exists <local/hwinfo_udevadm>
} }
include if exists <local/hwinfo> include if exists <local/hwinfo>

10
apparmor.d/profiles-g-l/inxi
View file

@ -138,15 +138,7 @@ profile inxi @{exec_path} {
profile udevadm { profile udevadm {
include <abstractions/base> include <abstractions/base>
include <abstractions/common/systemd> include <abstractions/app/udevadm>
@{bin}/udevadm mr,
/etc/udev/udev.conf r,
@{run}/udev/data/b* r,
@{sys}/devices/@{pci}/block/**/uevent r,
include if exists <local/inxi_udevadm> include if exists <local/inxi_udevadm>
} }

20
apparmor.d/profiles-m-r/parted
View file

@ -48,26 +48,12 @@ profile parted @{exec_path} {
profile udevadm { profile udevadm {
include <abstractions/base> include <abstractions/base>
include <abstractions/app/udevadm>
include <abstractions/disks-write>
ptrace (read),
@{bin}/udevadm mr,
/etc/udev/udev.conf r,
@{PROC}/1/cgroup r,
@{PROC}/1/environ r,
@{PROC}/1/sched r,
@{PROC}/cmdline r,
@{PROC}/sys/kernel/osrelease r,
@{PROC}/sys/kernel/random/boot_id r,
owner @{PROC}/@{pid}/cgroup r,
owner @{PROC}/@{pid}/stat r,
# file_inherit
include <abstractions/disks-write> # lots of files in this abstraction get inherited
owner @{user_img_dirs}/{,**} rwk, owner @{user_img_dirs}/{,**} rwk,
include if exists <local/parted_udevadm>
} }
include if exists <local/parted> include if exists <local/parted>

22
apparmor.d/profiles-m-r/partprobe
View file

@ -43,26 +43,10 @@ profile partprobe @{exec_path} {
profile udevadm { profile udevadm {
include <abstractions/base> include <abstractions/base>
include <abstractions/app/udevadm>
include <abstractions/disks-write>
ptrace (read), include if exists <local/partprobe_udevadm>
@{bin}/udevadm mr,
/etc/udev/udev.conf r,
owner @{PROC}/@{pid}/stat r,
owner @{PROC}/@{pid}/cgroup r,
@{PROC}/cmdline r,
@{PROC}/1/sched r,
@{PROC}/1/environ r,
@{PROC}/1/cgroup r,
@{PROC}/sys/kernel/osrelease r,
@{PROC}/sys/kernel/random/boot_id r,
# file_inherit
include <abstractions/disks-write> # lots of files in this abstraction get inherited
/dev/mapper/control rw,
} }
include if exists <local/partprobe> include if exists <local/partprobe>

8
apparmor.d/profiles-s-z/sensors-detect
View file

@ -41,13 +41,7 @@ profile sensors-detect @{exec_path} {
profile udevadm { profile udevadm {
include <abstractions/base> include <abstractions/base>
include <abstractions/common/systemd> include <abstractions/app/udevadm>
capability sys_ptrace,
@{bin}/udevadm mr,
/etc/udev/udev.conf r,
include if exists <local/sensors-detect_udevadm> include if exists <local/sensors-detect_udevadm>
} }

24
apparmor.d/profiles-s-z/xinit
View file

@ -92,29 +92,7 @@ profile xinit @{exec_path} {
profile udevadm { profile udevadm {
include <abstractions/base> include <abstractions/base>
include <abstractions/app/udevadm>
@{bin}/udevadm mr,
/etc/udev/udev.conf r,
@{run}/udev/data/* r,
@{sys}/bus/ r,
@{sys}/bus/*/devices/ r,
@{sys}/class/ r,
@{sys}/class/*/ r,
@{sys}/devices/**/uevent r,
@{sys}/firmware/efi/efivars/SecureBoot-@{uuid} r,
@{PROC}/1/environ r,
@{PROC}/1/sched r,
@{PROC}/cmdline r,
@{PROC}/sys/kernel/osrelease r,
owner @{PROC}/@{pid}/stat r,
# file_inherit
owner /dev/tty@{int} rw,
owner @{HOME}/.xsession-errors w,
include if exists <local/xinit_udevadm> include if exists <local/xinit_udevadm>
} }