mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2025-01-18 00:48:10 +01:00
feat(abs): add udevadm app abstraction.
This commit is contained in:
Alexandre Pujol
parent
39bfa9a40b
commit
035e1da7b2
14 changed files with 51 additions and 178 deletions
26
apparmor.d/abstractions/app/udevadm
Normal file
26
apparmor.d/abstractions/app/udevadm
Normal file
|
|
@ -0,0 +1,26 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
ptrace read peer=@{p_systemd},
|
||||
|
||||
@{bin}/udevadm mr,
|
||||
|
||||
/etc/udev/udev.conf r,
|
||||
|
||||
@{run}/udev/data/* r,
|
||||
|
||||
@{sys}/** r,
|
||||
|
||||
@{PROC}/1/cgroup r,
|
||||
@{PROC}/1/environ r,
|
||||
@{PROC}/1/sched r,
|
||||
@{PROC}/cmdline r,
|
||||
@{PROC}/sys/kernel/osrelease r,
|
||||
@{PROC}/sys/kernel/random/boot_id r,
|
||||
owner @{PROC}/@{pid}/cgroup r,
|
||||
owner @{PROC}/@{pid}/stat r,
|
||||
|
||||
include if exists <abstractions/app/udevadm.d>
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
|
@ -139,18 +139,7 @@ profile x11-xsession @{exec_path} {
|
|||
|
||||
profile udevadm {
|
||||
include <abstractions/base>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
@{bin}/udevadm mr,
|
||||
|
||||
/etc/udev/udev.conf r,
|
||||
|
||||
@{sys}/bus/ r,
|
||||
@{sys}/bus/*/devices/ r,
|
||||
@{sys}/class/ r,
|
||||
@{sys}/class/*/ r,
|
||||
@{sys}/devices/**/uevent r,
|
||||
@{run}/udev/data/* r,
|
||||
include <abstractions/app/udevadm>
|
||||
|
||||
include if exists <local/x11-xsession_udevadm>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -34,11 +34,7 @@ profile netplan.script @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
profile udevadm {
|
||||
include <abstractions/base>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
@{bin}/udevadm mr,
|
||||
|
||||
/etc/udev/udev.conf r,
|
||||
include <abstractions/app/udevadm>
|
||||
|
||||
@{run}/udev/control rw,
|
||||
@{run}/udev/rules.d/90-netplan.rules rw,
|
||||
|
|
|
|||
|
|
@ -37,26 +37,12 @@ profile f3fix @{exec_path} {
|
|||
|
||||
profile udevadm {
|
||||
include <abstractions/base>
|
||||
include <abstractions/app/udevadm>
|
||||
include <abstractions/disks-write>
|
||||
|
||||
ptrace (read),
|
||||
|
||||
@{bin}/udevadm mr,
|
||||
|
||||
/etc/udev/udev.conf r,
|
||||
|
||||
owner @{PROC}/@{pid}/stat r,
|
||||
owner @{PROC}/@{pid}/cgroup r,
|
||||
@{PROC}/cmdline r,
|
||||
@{PROC}/1/sched r,
|
||||
@{PROC}/1/environ r,
|
||||
@{PROC}/sys/kernel/osrelease r,
|
||||
@{PROC}/sys/kernel/random/boot_id r,
|
||||
|
||||
@{sys}/firmware/efi/efivars/SecureBoot-@{uuid} r,
|
||||
|
||||
# file_inherit
|
||||
/dev/sd[a-z]* rw,
|
||||
ptrace read,
|
||||
|
||||
include if exists <local/f3fix_udevadm>
|
||||
}
|
||||
|
||||
include if exists <local/f3fix>
|
||||
|
|
|
|||
|
|
@ -36,26 +36,10 @@ profile fatresize @{exec_path} {
|
|||
|
||||
profile udevadm {
|
||||
include <abstractions/base>
|
||||
include <abstractions/app/udevadm>
|
||||
include <abstractions/disks-write>
|
||||
|
||||
ptrace (read),
|
||||
|
||||
@{bin}/udevadm mr,
|
||||
|
||||
/etc/udev/udev.conf r,
|
||||
|
||||
owner @{PROC}/@{pid}/stat r,
|
||||
owner @{PROC}/@{pid}/cgroup r,
|
||||
@{PROC}/cmdline r,
|
||||
@{PROC}/1/sched r,
|
||||
@{PROC}/1/environ r,
|
||||
@{PROC}/sys/kernel/osrelease r,
|
||||
@{PROC}/sys/kernel/random/boot_id r,
|
||||
|
||||
@{sys}/firmware/efi/efivars/SecureBoot-@{uuid} r,
|
||||
|
||||
# file_inherit
|
||||
/dev/{s,v}d[a-z]* rw,
|
||||
|
||||
include if exists <local/fatresize_udevadm>
|
||||
}
|
||||
|
||||
include if exists <local/fatresize>
|
||||
|
|
|
|||
|
|
@ -60,16 +60,10 @@ profile gparted @{exec_path} {
|
|||
|
||||
profile udevadm {
|
||||
include <abstractions/base>
|
||||
include <abstractions/common/systemd>
|
||||
include <abstractions/app/udevadm>
|
||||
|
||||
@{bin}/udevadm mr,
|
||||
|
||||
/etc/udev/udev.conf r,
|
||||
|
||||
@{sys}/** r,
|
||||
@{sys}/devices/virtual/block/**/uevent rw,
|
||||
@{sys}/devices/@{pci}/block/**/uevent rw,
|
||||
@{run}/udev/data/* r,
|
||||
|
||||
include if exists <local/gparted_udevadm>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -132,24 +132,10 @@ profile gpartedbin @{exec_path} {
|
|||
|
||||
profile udevadm {
|
||||
include <abstractions/base>
|
||||
include <abstractions/app/udevadm>
|
||||
include <abstractions/disks-write>
|
||||
|
||||
ptrace (read),
|
||||
|
||||
@{bin}/udevadm mr,
|
||||
|
||||
/etc/udev/udev.conf r,
|
||||
|
||||
@{PROC}/1/environ r,
|
||||
@{PROC}/1/sched r,
|
||||
@{PROC}/cmdline r,
|
||||
@{PROC}/sys/kernel/osrelease r,
|
||||
@{PROC}/sys/kernel/random/boot_id r,
|
||||
owner @{PROC}/@{pid}/cgroup r,
|
||||
owner @{PROC}/@{pid}/stat r,
|
||||
|
||||
/dev/mapper/control rw,
|
||||
|
||||
include if exists <local/gpartedbin_udevadm>
|
||||
}
|
||||
|
||||
include if exists <local/gpartedbin>
|
||||
|
|
|
|||
|
|
@ -163,19 +163,9 @@ profile hw-probe @{exec_path} {
|
|||
include if exists <local/hw-probe_killall>
|
||||
}
|
||||
|
||||
profile udevadm {
|
||||
profile udevadm flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
@{bin}/udevadm mr,
|
||||
|
||||
/etc/udev/udev.conf r,
|
||||
|
||||
@{sys}/bus/ r,
|
||||
@{sys}/bus/*/devices/ r,
|
||||
@{sys}/class/ r,
|
||||
@{sys}/class/*/ r,
|
||||
@{sys}/devices/**/uevent r,
|
||||
include <abstractions/app/udevadm>
|
||||
|
||||
include if exists <local/hw-probe_udevadm>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -92,23 +92,11 @@ profile hwinfo @{exec_path} {
|
|||
|
||||
profile udevadm {
|
||||
include <abstractions/base>
|
||||
include <abstractions/app/udevadm>
|
||||
|
||||
@{bin}/udevadm mr,
|
||||
|
||||
/etc/udev/udev.conf r,
|
||||
|
||||
owner @{PROC}/@{pid}/stat r,
|
||||
@{PROC}/cmdline r,
|
||||
@{PROC}/1/sched r,
|
||||
@{PROC}/1/environ r,
|
||||
@{PROC}/sys/kernel/osrelease r,
|
||||
|
||||
@{sys}/** r,
|
||||
@{run}/udev/data/* r,
|
||||
|
||||
# file_inherit
|
||||
owner @{tmp}/hwinfo*.txt rw,
|
||||
|
||||
include if exists <local/hwinfo_udevadm>
|
||||
}
|
||||
|
||||
include if exists <local/hwinfo>
|
||||
|
|
|
|||
|
|
@ -138,15 +138,7 @@ profile inxi @{exec_path} {
|
|||
|
||||
profile udevadm {
|
||||
include <abstractions/base>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
@{bin}/udevadm mr,
|
||||
|
||||
/etc/udev/udev.conf r,
|
||||
|
||||
@{run}/udev/data/b* r,
|
||||
|
||||
@{sys}/devices/@{pci}/block/**/uevent r,
|
||||
include <abstractions/app/udevadm>
|
||||
|
||||
include if exists <local/inxi_udevadm>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -48,26 +48,12 @@ profile parted @{exec_path} {
|
|||
|
||||
profile udevadm {
|
||||
include <abstractions/base>
|
||||
include <abstractions/app/udevadm>
|
||||
include <abstractions/disks-write>
|
||||
|
||||
ptrace (read),
|
||||
|
||||
@{bin}/udevadm mr,
|
||||
|
||||
/etc/udev/udev.conf r,
|
||||
|
||||
@{PROC}/1/cgroup r,
|
||||
@{PROC}/1/environ r,
|
||||
@{PROC}/1/sched r,
|
||||
@{PROC}/cmdline r,
|
||||
@{PROC}/sys/kernel/osrelease r,
|
||||
@{PROC}/sys/kernel/random/boot_id r,
|
||||
owner @{PROC}/@{pid}/cgroup r,
|
||||
owner @{PROC}/@{pid}/stat r,
|
||||
|
||||
# file_inherit
|
||||
include <abstractions/disks-write> # lots of files in this abstraction get inherited
|
||||
owner @{user_img_dirs}/{,**} rwk,
|
||||
|
||||
include if exists <local/parted_udevadm>
|
||||
}
|
||||
|
||||
include if exists <local/parted>
|
||||
|
|
|
|||
|
|
@ -43,26 +43,10 @@ profile partprobe @{exec_path} {
|
|||
|
||||
profile udevadm {
|
||||
include <abstractions/base>
|
||||
include <abstractions/app/udevadm>
|
||||
include <abstractions/disks-write>
|
||||
|
||||
ptrace (read),
|
||||
|
||||
@{bin}/udevadm mr,
|
||||
|
||||
/etc/udev/udev.conf r,
|
||||
|
||||
owner @{PROC}/@{pid}/stat r,
|
||||
owner @{PROC}/@{pid}/cgroup r,
|
||||
@{PROC}/cmdline r,
|
||||
@{PROC}/1/sched r,
|
||||
@{PROC}/1/environ r,
|
||||
@{PROC}/1/cgroup r,
|
||||
@{PROC}/sys/kernel/osrelease r,
|
||||
@{PROC}/sys/kernel/random/boot_id r,
|
||||
|
||||
# file_inherit
|
||||
include <abstractions/disks-write> # lots of files in this abstraction get inherited
|
||||
/dev/mapper/control rw,
|
||||
|
||||
include if exists <local/partprobe_udevadm>
|
||||
}
|
||||
|
||||
include if exists <local/partprobe>
|
||||
|
|
|
|||
|
|
@ -41,13 +41,7 @@ profile sensors-detect @{exec_path} {
|
|||
|
||||
profile udevadm {
|
||||
include <abstractions/base>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability sys_ptrace,
|
||||
|
||||
@{bin}/udevadm mr,
|
||||
|
||||
/etc/udev/udev.conf r,
|
||||
include <abstractions/app/udevadm>
|
||||
|
||||
include if exists <local/sensors-detect_udevadm>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -92,29 +92,7 @@ profile xinit @{exec_path} {
|
|||
|
||||
profile udevadm {
|
||||
include <abstractions/base>
|
||||
|
||||
@{bin}/udevadm mr,
|
||||
|
||||
/etc/udev/udev.conf r,
|
||||
|
||||
@{run}/udev/data/* r,
|
||||
|
||||
@{sys}/bus/ r,
|
||||
@{sys}/bus/*/devices/ r,
|
||||
@{sys}/class/ r,
|
||||
@{sys}/class/*/ r,
|
||||
@{sys}/devices/**/uevent r,
|
||||
@{sys}/firmware/efi/efivars/SecureBoot-@{uuid} r,
|
||||
|
||||
@{PROC}/1/environ r,
|
||||
@{PROC}/1/sched r,
|
||||
@{PROC}/cmdline r,
|
||||
@{PROC}/sys/kernel/osrelease r,
|
||||
owner @{PROC}/@{pid}/stat r,
|
||||
|
||||
# file_inherit
|
||||
owner /dev/tty@{int} rw,
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
include <abstractions/app/udevadm>
|
||||
|
||||
include if exists <local/xinit_udevadm>
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in a new issue