mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-11-14 23:43:56 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat(profiles): rename all systemd generator.

Browse Source
This commit is contained in:
Alexandre Pujol 2023-11-22 20:51:10 +00:00
parent ba1cad7f73
commit 07acb8043b
No known key found for this signature in database
GPG Key ID: C5469996F0DF68EC
9 changed files with 110 additions and 75 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
apparmor.d/groups/systemd/systemd-generator-fstab Normal file
View File

@ -0,0 +1,25 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/systemd/system-generators/systemd-fstab-generator
profile systemd-generator-fstab @{exec_path} {
include <abstractions/base>
include <abstractions/systemd-common>
capability dac_override,
@{exec_path} mr,
/etc/fstab r,
@{run}/systemd/generator/** w,
@{PROC}/@{pid}/cgroup r,
include if exists <local/systemd-generator-fstab>
}

25
apparmor.d/groups/systemd/systemd-generator-getty Normal file
View File

@ -0,0 +1,25 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/systemd/system-generators/systemd-getty-generator
profile systemd-generator-getty @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/systemd-common>
@{exec_path} mr,
@{run}/systemd/generator/getty.target.wants/ w,
@{run}/systemd/generator/getty.target.wants/serial-getty@ttyS@{int}.service w,
@{sys}/devices/virtual/tty/console/active r,
@{PROC}/@{pid}/cgroup r,
include if exists <local/systemd-generator-getty>
}

30
apparmor.d/groups/systemd/systemd-generator-gpt-auto Normal file
View File

@ -0,0 +1,30 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/systemd/system-generators/systemd-gpt-auto-generator
profile systemd-generator-gpt-auto @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/disks-read>
include <abstractions/systemd-common>
capability sys_admin,
@{exec_path} mr,
/ r,
/boot/ r,
/efi/ r,
/etc/fstab r,
@{run}/systemd/generator.late/**.{,auto}mount w,
@{run}/systemd/generator.late/local-fs.target.wants/ w,
@{PROC}/@{pid}/cgroup r,
include if exists <local/systemd-generator-gpt-auto>
}

6
apparmor.d/groups/systemd/systemd-xdg-autostart-generator → apparmor.d/groups/systemd/systemd-generator-user-autostart
View File

@ -1,5 +1,5 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# Copyright (C) 2021-2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/systemd/user-generators/systemd-xdg-autostart-generator
profile systemd-xdg-autostart-generator @{exec_path} {
profile systemd-generator-user-autostart @{exec_path} {
include <abstractions/base>
include <abstractions/systemd-common>
include <abstractions/nameservice-strict>
@ -23,5 +23,5 @@ profile systemd-xdg-autostart-generator @{exec_path} {
owner @{PROC}/@{pid}/cgroup r,
include if exists <local/systemd-xdg-autostart-generator>
include if exists <local/systemd-generator-user-autostart>
}

4
apparmor.d/groups/systemd/systemd-environment-d-generator → apparmor.d/groups/systemd/systemd-generator-user-environment
View File

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/systemd/user-environment-generators/*
profile systemd-environment-d-generator @{exec_path} {
profile systemd-generator-user-environment @{exec_path} {
include <abstractions/base>
include <abstractions/systemd-common>
include <abstractions/nameservice-strict>
@ -28,5 +28,5 @@ profile systemd-environment-d-generator @{exec_path} {
/dev/tty rw,
include if exists <local/systemd-environment-d-generator>
include if exists <local/systemd-generator-user-environment>
}

27
apparmor.d/groups/systemd/systemd-user-generators-autostart
View File

@ -1,27 +0,0 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /usr/lib/systemd/user-generators/systemd-xdg-autostart-generator
profile systemd-user-generators-autostart @{exec_path} {
include <abstractions/base>
ptrace (read) peer=unconfined,
@{exec_path} mr,
/etc/xdg/autostart/{,*.desktop} r,
owner @{run}/user/@{uid}/systemd/generator.late/{,**} rw,
@{PROC}/cmdline r,
@{PROC}/sys/kernel/osrelease r,
@{PROC}/1/environ r,
@{PROC}/@{pids}/cgroup r,
include if exists <local/systemd-user-generators-autostart>
}

21
apparmor.d/groups/systemd/systemd-user-generators-environment
View File

@ -1,21 +0,0 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator
profile systemd-user-generators-environment @{exec_path} {
include <abstractions/base>
@{exec_path} mr,
/etc/environment.d/{,**} r,
@{PROC}/cmdline r,
@{PROC}/sys/kernel/osrelease r,
include if exists <local/systemd-user-generators-environment>
}

6
apparmor.d/groups/systemd/systemd-user-generators-flatpak
View File

@ -6,11 +6,11 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /usr/lib/systemd/user-environment-generators/60-flatpak
profile systemd-user-generators-flatpak @{exec_path} {
@{exec_path} = @{lib}/systemd/user-environment-generators/60-flatpak
profile systemd-generator-user-environment-flatpak @{exec_path} {
include <abstractions/base>
@{exec_path} mr,
include if exists <local/systemd-user-generators-flatpak>
include if exists <local/systemd-generator-user-environment-flatpak>
}

41
dists/flags/main.flags
View File

@ -282,62 +282,65 @@ swtpm_ioctl complain
swtpm_localca complain
swtpm_setup complain
systemd-analyze complain
systemd-arch-generator complain
systemd-ask-password complain
systemd-backlight complain
systemd-binfmt attach_disconnected,complain
systemd-bless-boot-generator attach_disconnected,complain
systemd-cgls complain
systemd-cgtop complain
systemd-cloud-init-generator attach_disconnected,complain
systemd-coredump attach_disconnected,mediate_deleted,complain
systemd-cryptsetup complain
systemd-cryptsetup-generator attach_disconnected,complain
systemd-debug-generator attach_disconnected,complain
systemd-dissect complain
systemd-ds-identify-generator attach_disconnected,complain
systemd-environment-d-generator complain
systemd-escape complain
systemd-fstab-generator attach_disconnected,complain
systemd-getty-generator attach_disconnected,complain
systemd-gpt-auto-generator attach_disconnected,complain
systemd-hibernate-resume-generator attach_disconnected,complain
systemd-firstboot complain
systemd-generator-bless-boot attach_disconnected,complain
systemd-generator-cloud-init attach_disconnected,complain
systemd-generator-cryptsetup attach_disconnected,complain
systemd-generator-debug attach_disconnected,complain
systemd-generator-ds-identify attach_disconnected,complain
systemd-generator-environment-arch complain
systemd-generator-environment-flatpak complain
systemd-generator-fstab attach_disconnected,complain
systemd-generator-getty attach_disconnected,complain
systemd-generator-gpt-auto attach_disconnected,complain
systemd-generator-hibernate-resume attach_disconnected,complain
systemd-generator-integritysetup attach_disconnected,complain
systemd-generator-ostree attach_disconnected,complain
systemd-generator-run attach_disconnected,complain
systemd-generator-system-update attach_disconnected,complain
systemd-generator-user-autostart complain
systemd-generator-user-environment complain
systemd-generator-user-environment-flatpak complain
systemd-generator-veritysetup attach_disconnected,complain
systemd-homed attach_disconnected,complain
systemd-homework complain
systemd-hostnamed attach_disconnected,complain
systemd-hwdb attach_disconnected,mediate_deleted,complain
systemd-inhibit attach_disconnected,complain
systemd-integritysetup-generator attach_disconnected,complain
systemd-localed attach_disconnected,complain
systemd-logind attach_disconnected,complain
systemd-machine-id-setup attach_disconnected,complain
systemd-modules-load complain
systemd-mount complain
systemd-network-generator complain
systemd-oomd attach_disconnected,complain
systemd-portabled complain
systemd-random-seed complain
systemd-remount-fs complain
systemd-resolve complain
systemd-resolved attach_disconnected,complain
systemd-run-generator attach_disconnected,complain
systemd-shutdown complain
systemd-sleep complain
systemd-system-update-generator attach_disconnected,complain
systemd-timedated attach_disconnected,complain
systemd-tty-ask-password-agent complain
systemd-udevd attach_disconnected,complain
systemd-update-done complain
systemd-update-utmp complain
systemd-user-generators-autostart complain
systemd-user-generators-environment complain
systemd-user-generators-flatpak complain
systemd-user-runtime-dir complain
systemd-user-sessions complain
systemd-userdbd attach_disconnected,complain
systemd-userwork complain
systemd-vconsole-setup complain
systemd-veritysetup-generator attach_disconnected,complain
systemd-xdg-autostart-generator complain
systemd.service attach_disconnected,complain
systemsettings complain
thunderbird complain
thunderbird-glxtest complain