mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-18 00:48:10 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Update acpid

Browse source
This commit is contained in:
nobodysu 2022-01-15 23:45:52 +00:00 committed by GitHub
parent 80bd1028c5
commit 0cb633ecec
Failed to generate hash of commit
1 changed files with 22 additions and 20 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

42
apparmor.d/profiles-a-f/acpid
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}{,s}bin/acpid
@{exec_path} = /{usr/,}{s,}bin/acpid
profile acpid @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/nameservice-strict>
@ -20,25 +20,24 @@ profile acpid @{exec_path} flags=(attach_disconnected) {
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/logger rix,
/etc/acpi/powerbtn-acpi-support.sh rPx -> acpid//powerbtn-acpi-support.sh,
/etc/acpi/{,**} r,
/etc/acpi/handler.sh rix,
/dev/input/{,**} r,
/dev/tty rw,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/loginuid r,
owner @{run}/acpid.socket rw,
owner @{run}/acpid.pid rw,
/etc/acpi/powerbtn-acpi-support.sh rPx -> acpid//powerbtn-acpi-support.sh,
owner @{PROC}/@{pids}/fd/ r,
owner @{PROC}/@{pids}/loginuid r,
/dev/input/{,**} r,
/dev/tty rw,
include if exists <local/acpid>
}
profile acpid//powerbtn-acpi-support.sh flags=(attach_disconnected) {
/etc/acpi/powerbtn-acpi-support.sh r,
include <abstractions/base>
include <abstractions/wutmp>
@ -47,16 +46,8 @@ profile acpid//powerbtn-acpi-support.sh flags=(attach_disconnected) {
ptrace (read), # unconfined, tighten later, TODO
deny / r,
/etc/acpi/powerbtn-acpi-support.sh r,
@{PROC} r,
@{PROC}/uptime r,
@{PROC}/sys/kernel/osrelease r,
@{PROC}/@{pid}/stat r,
@{PROC}/@{pid}/cmdline r,
/usr/share/acpi-support/** r,
/{usr/,}bin/sed rix,
/{usr/,}bin/pgrep rix,
/{usr/,}bin/{,e}grep rix,
@ -72,14 +63,25 @@ profile acpid//powerbtn-acpi-support.sh flags=(attach_disconnected) {
/{usr/,}bin/fgconsole rCx,
profile fgconsole /usr/bin/fgconsole {
/{usr/,}bin/fgconsole r,
include <abstractions/base>
capability sys_tty_config,
/{usr/,}bin/fgconsole r,
/dev/tty rw,
owner /dev/tty[0-9]* rw,
}
include if exists <local/powerbtn-acpi-support.sh>
/usr/share/acpi-support/** r,
deny / r,
@{PROC} r,
@{PROC}/uptime r,
@{PROC}/sys/kernel/osrelease r,
@{PROC}/@{pids}/stat r,
@{PROC}/@{pids}/cmdline r,
include if exists <local/acpid_powerbtn-acpi-support.sh>
}