mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-18 08:58:15 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

New @{uuid} variable.

Browse source
This commit is contained in:
Alexandre Pujol 2022-02-22 13:14:46 +00:00
parent 773741c85e
commit 0ee2e4f7ad
Failed to generate hash of commit
24 changed files with 47 additions and 44 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
apparmor.d/abstractions/systemd-common
View file

@ -16,6 +16,6 @@
/dev/kmsg w, /dev/kmsg w,
@{sys}/firmware/efi/efivars/SecureBoot-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* r, @{sys}/firmware/efi/efivars/SecureBoot-@{uuid} r,
include if exists <abstractions/systemd-common.d> include if exists <abstractions/systemd-common.d>

2
apparmor.d/groups/apps/android-studio
View file

@ -257,7 +257,7 @@ profile android-studio @{exec_path} {
/usr/share/distro-info/*.csv r, /usr/share/distro-info/*.csv r,
owner /tmp/android-*/emulator-* w, owner /tmp/android-*/emulator-* w,
owner /tmp/android-*/[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*/opengl_* w, owner /tmp/android-*/@{uuid}/opengl_* w,
# file_inherit # file_inherit
owner @{HOME}/.android/avd/** r, owner @{HOME}/.android/avd/** r,

4
apparmor.d/groups/apps/code
View file

@ -128,9 +128,9 @@ profile code @{exec_path} {
owner @{run}/user/@{uid}/vscode-[0-9a-f]*-*-{shared,main}.sock rw, owner @{run}/user/@{uid}/vscode-[0-9a-f]*-*-{shared,main}.sock rw,
owner @{run}/user/@{uid}/vscode-git-askpass-[0-9a-f]*.sock rw, owner @{run}/user/@{uid}/vscode-git-askpass-[0-9a-f]*.sock rw,
owner /tmp/vscode-ipc-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*.sock rw, owner /tmp/vscode-ipc-@{uuid}.sock rw,
# For installing extensions # For installing extensions
owner /tmp/[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* rw, owner /tmp/@{uuid} rw,
# file_inherit # file_inherit
owner @{HOME}/.xsession-errors w, owner @{HOME}/.xsession-errors w,

2
apparmor.d/groups/apps/thunderbird
View file

@ -149,7 +149,7 @@ profile thunderbird @{exec_path} {
owner /tmp/mozilla_*/* rw, owner /tmp/mozilla_*/* rw,
owner /tmp/MozillaMailnews/ rw, owner /tmp/MozillaMailnews/ rw,
owner /tmp/MozillaMailnews/*.msf rw, owner /tmp/MozillaMailnews/*.msf rw,
owner /tmp/Temp-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*/ rw, owner /tmp/Temp-@{uuid}/ rw,
deny /dev/ r, deny /dev/ r,
/dev/urandom w, /dev/urandom w,

4
apparmor.d/groups/browsers/firefox-crashreporter
View file

@ -43,10 +43,10 @@ profile firefox-crashreporter @{exec_path} flags=(attach_disconnected) {
owner "@{MOZ_HOMEDIR}/firefox/Crash Reports/pending/[0-9a-f]*.{dmp,extra}" rw, owner "@{MOZ_HOMEDIR}/firefox/Crash Reports/pending/[0-9a-f]*.{dmp,extra}" rw,
owner @{MOZ_HOMEDIR}/firefox/*.*/minidumps/{,**} rw, owner @{MOZ_HOMEDIR}/firefox/*.*/minidumps/{,**} rw,
owner @{MOZ_HOMEDIR}/firefox/*.*/minidumps/[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*.{dmp,extra} rw, owner @{MOZ_HOMEDIR}/firefox/*.*/minidumps/@{uuid}.{dmp,extra} rw,
owner @{MOZ_HOMEDIR}/firefox/*.*/crashes/{,**} rw, owner @{MOZ_HOMEDIR}/firefox/*.*/crashes/{,**} rw,
owner @{MOZ_HOMEDIR}/firefox/*.*/crashes/events/[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* rw, owner @{MOZ_HOMEDIR}/firefox/*.*/crashes/events/@{uuid} rw,
/tmp/ r, /tmp/ r,
owner /tmp/[0-9a-f]*.{dmp,extra} rw, owner /tmp/[0-9a-f]*.{dmp,extra} rw,

2
apparmor.d/groups/browsers/firefox-minidump-analyzer
View file

@ -27,7 +27,7 @@ profile firefox-minidump-analyzer @{exec_path} {
owner "@{MOZ_HOMEDIR}/firefox/Crash Reports/pending/[0-9a-f]*.{dmp,extra}" rw, owner "@{MOZ_HOMEDIR}/firefox/Crash Reports/pending/[0-9a-f]*.{dmp,extra}" rw,
owner @{MOZ_HOMEDIR}/firefox/*.*/minidumps/ rw, owner @{MOZ_HOMEDIR}/firefox/*.*/minidumps/ rw,
owner @{MOZ_HOMEDIR}/firefox/*.*/minidumps/[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*.{dmp,extra} rw, owner @{MOZ_HOMEDIR}/firefox/*.*/minidumps/@{uuid}.{dmp,extra} rw,
owner /dev/shm/org.mozilla.ipc.[0-9]*.[0-9]* r, owner /dev/shm/org.mozilla.ipc.[0-9]*.[0-9]* r,

2
apparmor.d/groups/browsers/firefox-pingsender
View file

@ -22,7 +22,7 @@ profile firefox-pingsender @{exec_path} {
@{exec_path} mr, @{exec_path} mr,
owner @{HOME}/.mozilla/firefox/*.*/saved-telemetry-pings/[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* rw, owner @{HOME}/.mozilla/firefox/*.*/saved-telemetry-pings/@{uuid} rw,
# file_inherit # file_inherit
owner /dev/tty[0-9]* rw, owner /dev/tty[0-9]* rw,

2
apparmor.d/groups/network/nm-openvpn-service
View file

@ -25,7 +25,7 @@ profile nm-openvpn-service @{exec_path} {
/{usr/,}bin/kmod rPx, /{usr/,}bin/kmod rPx,
@{run}/systemd/userdb/ r, @{run}/systemd/userdb/ r,
@{run}/NetworkManager/nm-openvpn-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* rw, @{run}/NetworkManager/nm-openvpn-@{uuid} rw,
/dev/net/tun rw, /dev/net/tun rw,
/dev/tty rw, /dev/tty rw,

2
apparmor.d/groups/network/openvpn
View file

@ -62,7 +62,7 @@ profile openvpn @{exec_path} {
/var/log/openvpn/*.log w, /var/log/openvpn/*.log w,
@{run}/openvpn/*.{pid,status} rw, @{run}/openvpn/*.{pid,status} rw,
@{run}/NetworkManager/nm-openvpn-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* rw, @{run}/NetworkManager/nm-openvpn-@{uuid} rw,
/{usr/,}bin/ip rix, /{usr/,}bin/ip rix,
/{usr/,}bin/systemd-ask-password rPx, /{usr/,}bin/systemd-ask-password rPx,

28
apparmor.d/groups/systemd/bootctl
View file

@ -42,20 +42,20 @@ profile bootctl @{exec_path} {
@{sys}/firmware/dmi/entries/*/raw r, @{sys}/firmware/dmi/entries/*/raw r,
@{sys}/firmware/efi/efivars/ r, @{sys}/firmware/efi/efivars/ r,
@{sys}/firmware/efi/efivars/Boot[0-9A-F]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* r, @{sys}/firmware/efi/efivars/Boot[0-9A-F]*-@{uuid} r,
@{sys}/firmware/efi/efivars/BootOrder-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* r, @{sys}/firmware/efi/efivars/BootOrder-@{uuid} r,
@{sys}/firmware/efi/efivars/LoaderDevicePartUUID-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* r, @{sys}/firmware/efi/efivars/LoaderDevicePartUUID-@{uuid} r,
@{sys}/firmware/efi/efivars/LoaderEntries-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* r, @{sys}/firmware/efi/efivars/LoaderEntries-@{uuid} r,
@{sys}/firmware/efi/efivars/LoaderFeatures-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* r, @{sys}/firmware/efi/efivars/LoaderFeatures-@{uuid} r,
@{sys}/firmware/efi/efivars/LoaderFirmwareInfo-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* r, @{sys}/firmware/efi/efivars/LoaderFirmwareInfo-@{uuid} r,
@{sys}/firmware/efi/efivars/LoaderFirmwareType-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* r, @{sys}/firmware/efi/efivars/LoaderFirmwareType-@{uuid} r,
@{sys}/firmware/efi/efivars/LoaderImageIdentifier-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* r, @{sys}/firmware/efi/efivars/LoaderImageIdentifier-@{uuid} r,
@{sys}/firmware/efi/efivars/LoaderInfo-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* r, @{sys}/firmware/efi/efivars/LoaderInfo-@{uuid} r,
@{sys}/firmware/efi/efivars/LoaderSystemToken-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* r, @{sys}/firmware/efi/efivars/LoaderSystemToken-@{uuid} r,
@{sys}/firmware/efi/efivars/OsIndications-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* r, @{sys}/firmware/efi/efivars/OsIndications-@{uuid} r,
@{sys}/firmware/efi/efivars/OsIndicationsSupported-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* r, @{sys}/firmware/efi/efivars/OsIndicationsSupported-@{uuid} r,
@{sys}/firmware/efi/efivars/SecureBoot-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* r, @{sys}/firmware/efi/efivars/SecureBoot-@{uuid} r,
@{sys}/firmware/efi/efivars/SetupMode-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* r, @{sys}/firmware/efi/efivars/SetupMode-@{uuid} r,
owner @{PROC}/@{pid}/cgroup r, owner @{PROC}/@{pid}/cgroup r,
@{PROC}/sys/kernel/random/poolsize r, @{PROC}/sys/kernel/random/poolsize r,

2
apparmor.d/groups/systemd/child-systemctl
View file

@ -36,7 +36,7 @@ profile child-systemctl flags=(attach_disconnected) {
@{PROC}/1/sched r, @{PROC}/1/sched r,
@{PROC}/cmdline r, @{PROC}/cmdline r,
@{sys}/firmware/efi/efivars/SecureBoot-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* r, @{sys}/firmware/efi/efivars/SecureBoot-@{uuid} r,
/dev/kmsg w, /dev/kmsg w,

4
apparmor.d/groups/systemd/systemd-analyze
View file

@ -57,8 +57,8 @@ profile systemd-analyze @{exec_path} {
/etc/default/locale r, /etc/default/locale r,
/etc/locale.conf r, /etc/locale.conf r,
@{sys}/firmware/efi/efivars/LoaderTimeInitUSec-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* r, @{sys}/firmware/efi/efivars/LoaderTimeInitUSec-@{uuid} r,
@{sys}/firmware/efi/efivars/LoaderTimeExecUSec-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* r, @{sys}/firmware/efi/efivars/LoaderTimeExecUSec-@{uuid} r,
/dev/tty rw, /dev/tty rw,
/dev/pts/1 rw, /dev/pts/1 rw,

2
apparmor.d/groups/systemd/systemd-journald
View file

@ -58,7 +58,7 @@ profile systemd-journald @{exec_path} {
@{run}/udev/data/+platform:simple-framebuffer.[0-9]* r, @{run}/udev/data/+platform:simple-framebuffer.[0-9]* r,
@{sys}/devices/**/uevent r, @{sys}/devices/**/uevent r,
@{sys}/firmware/efi/efivars/SecureBoot-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* r, @{sys}/firmware/efi/efivars/SecureBoot-@{uuid} r,
@{sys}/module/printk/parameters/time r, @{sys}/module/printk/parameters/time r,
@{PROC}/@{pids}/comm r, @{PROC}/@{pids}/comm r,

8
apparmor.d/groups/systemd/systemd-logind
View file

@ -84,10 +84,10 @@ profile systemd-logind @{exec_path} flags=(complain) {
@{sys}/class/drm/ r, @{sys}/class/drm/ r,
@{sys}/power/{state,resume_offset,resume,disk} r, @{sys}/power/{state,resume_offset,resume,disk} r,
@{sys}/firmware/efi/efivars/OsIndicationsSupported-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* r, @{sys}/firmware/efi/efivars/OsIndicationsSupported-@{uuid} r,
@{sys}/firmware/efi/efivars/OsIndications-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* r, @{sys}/firmware/efi/efivars/OsIndications-@{uuid} r,
@{sys}/firmware/efi/efivars/LoaderEntries-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* r, @{sys}/firmware/efi/efivars/LoaderEntries-@{uuid} r,
@{sys}/firmware/efi/efivars/LoaderFeatures-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* r, @{sys}/firmware/efi/efivars/LoaderFeatures-@{uuid} r,
@{PROC}/@{pid}/cgroup r, @{PROC}/@{pid}/cgroup r,
@{PROC}/@{pid}/comm r, @{PROC}/@{pid}/comm r,

2
apparmor.d/groups/systemd/systemd-resolved
View file

@ -44,5 +44,5 @@ profile systemd-resolved @{exec_path} {
@{PROC}/sys/kernel/random/boot_id r, @{PROC}/sys/kernel/random/boot_id r,
# System access # System access
@{sys}/firmware/efi/efivars/SecureBoot-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* r, @{sys}/firmware/efi/efivars/SecureBoot-@{uuid} r,
} }

4
apparmor.d/groups/virt/libvirtd
View file

@ -72,7 +72,7 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) {
signal (send) set=(term) peer=libvirtd//qemu_bridge_helper, signal (send) set=(term) peer=libvirtd//qemu_bridge_helper,
# allow connect with openGraphicsFD, direction reversed in newer versions # allow connect with openGraphicsFD, direction reversed in newer versions
unix (send, receive) type=stream addr=none peer=(label=libvirt-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*), unix (send, receive) type=stream addr=none peer=(label=libvirt-@{uuid}),
# unconfined also required if guests run without security module # unconfined also required if guests run without security module
unix (send, receive) type=stream addr=none peer=(label=unconfined), unix (send, receive) type=stream addr=none peer=(label=unconfined),
@ -113,7 +113,7 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) {
/etc/xen/scripts/** rmix, /etc/xen/scripts/** rmix,
# allow changing to our UUID-based named profiles # allow changing to our UUID-based named profiles
change_profile -> libvirt-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*, change_profile -> libvirt-@{uuid},
/usr/{lib,lib64,lib/qemu,libexec}/qemu-bridge-helper Cx -> qemu_bridge_helper, /usr/{lib,lib64,lib/qemu,libexec}/qemu-bridge-helper Cx -> qemu_bridge_helper,
# child profile for bridge helper process # child profile for bridge helper process

4
apparmor.d/profiles-a-f/btrfs
View file

@ -29,8 +29,8 @@ profile btrfs @{exec_path} {
# For scrub # For scrub
/var/lib/btrfs/ rw, /var/lib/btrfs/ rw,
/var/lib/btrfs/scrub.progress.[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* rw, /var/lib/btrfs/scrub.progress.@{uuid} rw,
/var/lib/btrfs/scrub.status.[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*{,_tmp} rwk, /var/lib/btrfs/scrub.status.@{uuid}{,_tmp} rwk,
# Saved metadata # Saved metadata
@{MOUNTS}/*/ r, @{MOUNTS}/*/ r,

2
apparmor.d/profiles-a-f/f3fix
View file

@ -51,7 +51,7 @@ profile f3fix @{exec_path} {
@{PROC}/sys/kernel/osrelease r, @{PROC}/sys/kernel/osrelease r,
@{PROC}/sys/kernel/random/boot_id r, @{PROC}/sys/kernel/random/boot_id r,
@{sys}/firmware/efi/efivars/SecureBoot-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* r, @{sys}/firmware/efi/efivars/SecureBoot-@{uuid} r,
# file_inherit # file_inherit
/dev/sd[a-z]* rw, /dev/sd[a-z]* rw,

2
apparmor.d/profiles-a-f/fatresize
View file

@ -50,7 +50,7 @@ profile fatresize @{exec_path} {
@{PROC}/sys/kernel/osrelease r, @{PROC}/sys/kernel/osrelease r,
@{PROC}/sys/kernel/random/boot_id r, @{PROC}/sys/kernel/random/boot_id r,
@{sys}/firmware/efi/efivars/SecureBoot-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* r, @{sys}/firmware/efi/efivars/SecureBoot-@{uuid} r,
# file_inherit # file_inherit
/dev/{s,v}d[a-z]* rw, /dev/{s,v}d[a-z]* rw,

2
apparmor.d/profiles-g-l/lightdm-gtk-greeter
View file

@ -67,7 +67,7 @@ profile lightdm-gtk-greeter @{exec_path} {
@{PROC}/cmdline r, @{PROC}/cmdline r,
@{PROC}/sys/kernel/osrelease r, @{PROC}/sys/kernel/osrelease r,
@{sys}/firmware/efi/efivars/SecureBoot-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* r, @{sys}/firmware/efi/efivars/SecureBoot-@{uuid} r,
# file_inherit # file_inherit
/var/log/lightdm/seat[0-9]*-greeter.log w, /var/log/lightdm/seat[0-9]*-greeter.log w,

2
apparmor.d/profiles-g-l/logrotate
View file

@ -63,7 +63,7 @@ profile logrotate @{exec_path} flags=(attach_disconnected, complain) {
# logrotate[]: error: could not change directory to '.' # logrotate[]: error: could not change directory to '.'
/ r, / r,
@{sys}/firmware/efi/efivars/SecureBoot-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* r, @{sys}/firmware/efi/efivars/SecureBoot-@{uuid} r,
profile systemctl flags=(attach_disconnected, complain) { profile systemctl flags=(attach_disconnected, complain) {
include <abstractions/base> include <abstractions/base>

2
apparmor.d/profiles-s-z/x11-xsession
View file

@ -110,7 +110,7 @@ profile x11-xsession @{exec_path} {
@{PROC}/1/environ r, @{PROC}/1/environ r,
@{PROC}/sys/kernel/osrelease r, @{PROC}/sys/kernel/osrelease r,
@{sys}/firmware/efi/efivars/SecureBoot-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* r, @{sys}/firmware/efi/efivars/SecureBoot-@{uuid} r,
@{sys}/bus/ r, @{sys}/bus/ r,
@{sys}/bus/*/devices/ r, @{sys}/bus/*/devices/ r,

2
apparmor.d/profiles-s-z/xinit
View file

@ -118,7 +118,7 @@ profile xinit @{exec_path} {
@{PROC}/1/environ r, @{PROC}/1/environ r,
@{PROC}/sys/kernel/osrelease r, @{PROC}/sys/kernel/osrelease r,
@{sys}/firmware/efi/efivars/SecureBoot-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* r, @{sys}/firmware/efi/efivars/SecureBoot-@{uuid} r,
@{sys}/bus/ r, @{sys}/bus/ r,
@{sys}/bus/*/devices/ r, @{sys}/bus/*/devices/ r,

3
apparmor.d/tunables/extend
View file

@ -6,6 +6,9 @@
# To allow extended personalisation without breaking everything. # To allow extended personalisation without breaking everything.
# All apparmor profiles should always use the variables defined here. # All apparmor profiles should always use the variables defined here.
# Universally unique identifier
@{uuid}=[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*
# Common mountpoints # Common mountpoints
@{MOUNTS}=/media/ @{run}/media /mnt @{MOUNTS}=/media/ @{run}/media /mnt