mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-18 00:48:10 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat: merge pacman mkinitcpio hooks.

Browse source
This commit is contained in:
Alexandre Pujol 2022-12-10 19:12:10 +00:00
parent c453484eab
commit 11cc9bd672
Failed to generate hash of commit
2 changed files with 13 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
apparmor.d/groups/pacman/pacman-hook-mkinitcpio-install → apparmor.d/groups/pacman/pacman-hook-mkinitcpio
View file

@ -6,22 +6,24 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /usr/share/libalpm/scripts/mkinitcpio-install @{exec_path} = /usr/share/libalpm/scripts/mkinitcpio
profile pacman-hook-mkinitcpio-install @{exec_path} flags=(attach_disconnected) { profile pacman-hook-mkinitcpio @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
capability dac_read_search, capability dac_read_search,
capability mknod, capability mknod,
unix (receive) type=stream, # unix (receive) type=stream,
@{exec_path} mr, @{exec_path} mr,
/{usr/,}bin/bash rix, /{usr/,}bin/bash rix,
/{usr/,}bin/cmp rix,
/{usr/,}bin/compgen rix, /{usr/,}bin/compgen rix,
/{usr/,}bin/install rix, /{usr/,}bin/install rix,
/{usr/,}bin/mkinitcpio rPx, /{usr/,}bin/mkinitcpio rPx,
/{usr/,}bin/mv rix, /{usr/,}bin/mv rix,
/{usr/,}bin/rm rix,
/{usr/,}bin/sed rix, /{usr/,}bin/sed rix,
/usr/share/mkinitcpio/*.preset r, /usr/share/mkinitcpio/*.preset r,
@ -30,14 +32,16 @@ profile pacman-hook-mkinitcpio-install @{exec_path} flags=(attach_disconnected)
/etc/mkinitcpio.d/*.preset rw, /etc/mkinitcpio.d/*.preset rw,
/ r, / r,
owner /boot/vmlinuz-* rw, /boot/vmlinuz-* rw,
/boot/initramfs-*.img rw,
/boot/initramfs-*-fallback.img rw,
/dev/tty rw, # /dev/tty rw,
# Inherit Silencer # # Inherit Silencer
deny network inet6 stream, deny network inet6 stream,
deny network inet stream, deny network inet stream,
deny /apparmor/.null rw, # deny /apparmor/.null rw,
include if exists <local/pacman-hook-mkinitcpio-install> include if exists <local/pacman-hook-mkinitcpio>
} }

3
dists/flags/arch.flags
View file

@ -8,8 +8,7 @@ pacman-hook-dkms complain
pacman-hook-fontconfig complain pacman-hook-fontconfig complain
pacman-hook-gio complain pacman-hook-gio complain
pacman-hook-gtk complain pacman-hook-gtk complain
pacman-hook-mkinitcpio-install attach_disconnected,complain pacman-hook-mkinitcpio attach_disconnected,complain
pacman-hook-mkinitcpio-remove complain
pacman-hook-perl complain pacman-hook-perl complain
pacman-hook-systemd complain pacman-hook-systemd complain
pacman-key complain pacman-key complain