mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-30 23:05:11 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Rules fix.

Browse source
This commit is contained in:
Alexandre Pujol 2021-04-07 18:05:15 +01:00
parent 9446af57f8
commit 04f2d2c9a3
Failed to generate hash of commit
9 changed files with 14 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
apparmor.d/groups/desktop/accounts-daemon
View file

@ -14,6 +14,8 @@ profile accounts-daemon @{exec_path} {
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
# Needed? # Needed?
capability dac_read_search,
capability sys_ptrace,
deny capability sys_nice, deny capability sys_nice,
@{exec_path} mr, @{exec_path} mr,

2
apparmor.d/groups/gvfs/gvfsd-fuse
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Mikhail Morfikov # Copyright (C) 2021 Mikhail Morfikov
# 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>, abi <abi/3.0>,
@ -19,6 +20,7 @@ profile gvfsd-fuse @{exec_path} {
/dev/fuse rw, /dev/fuse rw,
@{PROC}/sys/fs/pipe-max-size r,
profile fusermount { profile fusermount {
include <abstractions/base> include <abstractions/base>

1
apparmor.d/groups/systemd/systemd-rfkill
View file

@ -13,6 +13,7 @@ profile systemd-rfkill @{exec_path} {
include <abstractions/systemd-common> include <abstractions/systemd-common>
capability net_admin, capability net_admin,
capability sys_ptrace,
network netlink raw, network netlink raw,

1
apparmor.d/groups/systemd/systemd-tmpfiles
View file

@ -21,6 +21,7 @@ profile systemd-tmpfiles @{exec_path} {
@{exec_path} mr, @{exec_path} mr,
/etc/machine-id r, /etc/machine-id r,
/etc/brlapi.key w,
/usr/share/factory/{,**} r, /usr/share/factory/{,**} r,
# Config file locations # Config file locations

4
apparmor.d/profiles-a-l/browserpass
View file

@ -22,8 +22,8 @@ profile browserpass @{exec_path} {
owner @{HOME}/.password-store/{,**} r, owner @{HOME}/.password-store/{,**} r,
owner @{HOME}/.mozilla/firefox/[0-9a-z]*.default/.parentlock rw, owner @{HOME}/.mozilla/firefox/[0-9a-z]*.default/.parentlock rw,
owner @{HOME}/.mozilla/firefox/[0-9a-z]*.default/extensions/* r, owner @{HOME}/.mozilla/firefox/[0-9a-z]*.default/extensions/* r,
owner @{HOME}/.mozilla/firefox/[0-9a-z]*.default/startupCache/scriptCache-*.bin r, owner @{user_cache_dirs}/mozilla/firefox/[0-9a-z]*.default/startupCache/scriptCache-*.bin r,
owner @{HOME}/.mozilla/firefox/[0-9a-z]*.default/startupCache/startupCache.*.little r, owner @{user_cache_dirs}/mozilla/firefox/[0-9a-z]*.default/startupCache/startupCache.*.little r,
@{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r, @{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r,

1
apparmor.d/profiles-a-l/git
View file

@ -18,6 +18,7 @@ include <tunables/global>
profile git @{exec_path} { profile git @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>
include <abstractions/openssl>
include <abstractions/ssl_certs> include <abstractions/ssl_certs>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>

2
apparmor.d/profiles-a-l/gitstatusd
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /usr/share/zsh-theme-powerlevel10k/gitstatus/usrbin/gitstatusd{,-*} @{exec_path} = /usr/share/zsh-theme-powerlevel[0-9]*k/gitstatus/usrbin/gitstatusd{,-*}
profile gitstatusd @{exec_path} { profile gitstatusd @{exec_path} {
include <abstractions/base> include <abstractions/base>

1
apparmor.d/profiles-m-z/polkitd
View file

@ -16,6 +16,7 @@ profile polkitd @{exec_path} {
capability setgid, capability setgid,
# Needed? # Needed?
capability sys_ptrace,
audit deny capability net_admin, audit deny capability net_admin,
@{exec_path} mr, @{exec_path} mr,

3
apparmor.d/profiles-m-z/udisksd
View file

@ -23,6 +23,9 @@ profile udisksd @{exec_path} flags=(attach_disconnected) {
# Error mounting /dev/sd* at /media/*/*: Operation not permitted. # Error mounting /dev/sd* at /media/*/*: Operation not permitted.
capability sys_admin, capability sys_admin,
capability dac_read_search,
capability dac_override,
# Needed? # Needed?
deny capability sys_nice, deny capability sys_nice,