mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-18 17:08:09 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(fsp): improve systemd profile.

Browse source
This commit is contained in:
Alexandre Pujol 2024-03-10 14:49:31 +00:00
parent 70b043cdae
commit 16d0af1c5e
Failed to generate hash of commit
2 changed files with 8 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
apparmor.d/groups/_full/systemd
View file

@ -57,9 +57,9 @@ profile systemd flags=(attach_disconnected,mediate_deleted) {
mount fstype=autofs systemd-1 -> /efi/,
mount fstype=proc options=(rw nosuid nodev noexec) proc -> @{run}/systemd/namespace-@{rand6}/,
mount fstype=sysfs options=(rw nosuid nodev noexec) sysfs -> @{run}/systemd/namespace-@{rand6}/,
mount fstype=tmpfs tmpfs -> /dev/shm/,
mount fstype=tmpfs tmpfs -> /tmp/,
mount fstype=tmpfs options=(rw nosuid nodev noexec strictatime) tmpfs -> @{run}/systemd/mount-rootfs/@{run}/credentials/,
mount fstype=tmpfs options=(rw nosuid nodev noexec) tmpfs -> /dev/shm/,
mount fstype=tmpfs options=(rw nosuid noexec strictatime) tmpfs -> @{run}/systemd/namespace-@{rand6}/dev/,
mount options=(rw bind) /dev/** -> @{run}/systemd/namespace-@{rand6}/dev/**,
@ -184,6 +184,10 @@ profile systemd flags=(attach_disconnected,mediate_deleted) {
@{run}/initctl rw,
@{run}/systemd/{,**} rw,
@{run}/udev/data/+bluetooth:* r,
@{run}/udev/data/+backlight:* r,
@{run}/udev/data/+leds:*backlight* r,
@{run}/udev/data/+module:configfs r,
@{run}/udev/data/+module:fuse r,
@{run}/udev/data/c4:@{int} r, # For TTY devices

4
apparmor.d/groups/_full/systemd-service
View file

@ -2,7 +2,9 @@
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
# Profile for generic systemd unit services. Only used by service without profile.
# Profile for generic systemd unit services. Only used by tiny systemd services
# that start a shell or use context specific programs.
# It does not specify an attachment path because it is intended to be used only
# via "Px -> systemd-service" exec transitions from the systemd profile.