mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-02-21 17:35:50 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat: cleanup child-systemctl

Browse source
This commit is contained in:
Alexandre Pujol 2023-11-22 18:43:43 +00:00
parent 23be43ebd0
commit 04513af863
Failed to generate hash of commit
1 changed files with 2 additions and 15 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
apparmor.d/groups/children/child-systemctl
View file

@ -1,6 +1,6 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov # Copyright (C) 2019-2021 Mikhail Morfikov
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io> # Copyright (C) 2021-2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
# Note: This profile does not specify an attachment path because it is # Note: This profile does not specify an attachment path because it is
@ -18,14 +18,13 @@ profile child-systemctl flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>
include <abstractions/dbus-strict> include <abstractions/dbus-strict>
include <abstractions/systemd-common>
include <abstractions/wutmp> include <abstractions/wutmp>
capability mknod, capability mknod,
capability net_admin, capability net_admin,
capability sys_ptrace, capability sys_ptrace,
ptrace (read),
network inet stream, network inet stream,
network inet6 stream, network inet6 stream,
@ -46,18 +45,6 @@ profile child-systemctl flags=(attach_disconnected) {
@{run}/systemd/private rw, @{run}/systemd/private rw,
@{sys}/firmware/efi/efivars/SecureBoot-@{uuid} r,
@{PROC}/1/environ r,
@{PROC}/1/sched r,
@{PROC}/cmdline r,
@{PROC}/sys/kernel/osrelease r,
@{PROC}/sys/kernel/random/boot_id r,
@{PROC}/@{pid}/comm r,
owner @{PROC}/@{pid}/stat r,
/dev/kmsg w,
deny /apparmor/.null rw, deny /apparmor/.null rw,
include if exists <local/child-systemctl> include if exists <local/child-systemctl>