mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2024-11-15 07:54:17 +01:00
feat(profile): general update.
This commit is contained in:
parent
c0a081b827
commit
1675a26fbf
@ -8,8 +8,8 @@
|
||||
@{bin}/unix_chkpwd rPx,
|
||||
|
||||
#aa:only whonix
|
||||
@{lib}/security-misc/pam_faillock_not_if_x rPx,
|
||||
@{lib}/security-misc/pam-abort-on-locked-password rPx,
|
||||
@{lib}/security-misc/pam-info rPx,
|
||||
@{lib}/security-misc/pam_faillock_not_if_x rPx,
|
||||
|
||||
# vim:syntax=apparmor
|
||||
|
@ -10,9 +10,9 @@ include <tunables/global>
|
||||
@{exec_path} = @{bin}/udevadm @{lib}/systemd/systemd-udevd
|
||||
profile systemd-udevd @{exec_path} flags=(attach_disconnected,complain) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/common/systemd>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability chown,
|
||||
capability dac_override,
|
||||
@ -27,7 +27,7 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected,complain) {
|
||||
capability sys_rawio,
|
||||
capability sys_resource,
|
||||
|
||||
ptrace (read),
|
||||
ptrace read,
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
@ -74,15 +74,13 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected,complain) {
|
||||
/etc/console-setup/*.sh rPUx,
|
||||
/etc/network/cloud-ifupdown-helper rPUx,
|
||||
|
||||
/etc/machine-id r,
|
||||
|
||||
/etc/default/* r,
|
||||
|
||||
/etc/machine-id r,
|
||||
/etc/nfs.conf rk,
|
||||
|
||||
/etc/udev/{,**} r,
|
||||
/etc/udev/hwdb.bin rw,
|
||||
/etc/udev/.#hwdb.bin* rw,
|
||||
/etc/udev/hwdb.bin rw,
|
||||
|
||||
/etc/modprobe.d/ r,
|
||||
/etc/modprobe.d/*.conf r,
|
||||
|
@ -39,7 +39,7 @@ profile libreoffice @{exec_path} {
|
||||
@{bin}/sed rix,
|
||||
@{bin}/uname rix,
|
||||
|
||||
@{open_path} rpx -> child-open-browsers,
|
||||
@{open_path} rPx -> child-open-browsers,
|
||||
|
||||
@{bin}/gpgconf rPx,
|
||||
@{bin}/gpgsm rPx,
|
||||
@ -51,8 +51,10 @@ profile libreoffice @{exec_path} {
|
||||
@{lib}/jvm/java*/bin/java rix,
|
||||
@{lib}/jvm/java*/lib/** rm,
|
||||
|
||||
@{lib}/libreoffice/share/uno_packages/cache/stamp.sys w,
|
||||
@{lib}/libreoffice/{,**} rm,
|
||||
@{lib}/libreoffice/share/uno_packages/cache/stamp.sys w,
|
||||
@{lib}/libreoffice/program/{,**/}__pycache__/ w,
|
||||
@{lib}/libreoffice/share/extensions/{,**/}__pycache__/ w,
|
||||
|
||||
/usr/share/hyphen/{,**} r,
|
||||
/usr/share/libexttextcat/{,**} r,
|
||||
|
Loading…
Reference in New Issue
Block a user