mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-18 17:08:09 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(fsp): update mounting rules.

Browse source
This commit is contained in:
Alexandre Pujol 2024-03-15 23:45:18 +00:00
parent e3f9013c3a
commit 1b8b52962b
Failed to generate hash of commit
2 changed files with 15 additions and 7 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
apparmor.d/groups/_full/systemd
View file

@ -52,14 +52,18 @@ profile systemd flags=(attach_disconnected,mediate_deleted) {
network inet6 stream,
network netlink raw,
mount fstype=autofs systemd-1 -> /efi/,
mount fstype=proc options=(rw nosuid nodev noexec) proc -> @{run}/systemd/namespace-@{rand6}/,
mount fstype=sysfs options=(rw nosuid nodev noexec) sysfs -> @{run}/systemd/namespace-@{rand6}/,
mount fstype=tmpfs tmpfs -> /dev/shm/,
mount fstype=tmpfs tmpfs -> /tmp/,
mount fstype=tmpfs options=(rw nosuid nodev noexec strictatime) tmpfs -> @{run}/systemd/mount-rootfs/@{run}/credentials/,
mount fstype=tmpfs options=(rw nosuid noexec strictatime) tmpfs -> @{run}/systemd/namespace-@{rand6}/dev/,
mount fstype=autofs systemd-1 -> @{PROC}/sys/fs/binfmt_misc/,
mount fstype=autofs systemd-1 -> /efi/,
mount fstype=hugetlbfs options=(rw nosuid nodev) hugetlbfs -> /dev/hugepages/,
mount fstype=proc options=(rw nosuid nodev noexec) proc -> @{run}/systemd/namespace-@{rand6}/,
mount fstype=sysfs options=(rw nosuid nodev noexec) sysfs -> @{run}/systemd/namespace-@{rand6}/,
mount fstype=tmpfs tmpfs -> /dev/shm/,
mount fstype=tmpfs tmpfs -> /tmp/,
mount fstype=tmpfs options=(rw nosuid nodev noexec strictatime) tmpfs -> @{run}/systemd/mount-rootfs/@{run}/credentials/,
mount fstype=tmpfs options=(rw nosuid nodev noexec) tmpfs -> /dev/shm/,
mount fstype=tmpfs options=(rw nosuid noexec strictatime) tmpfs -> @{run}/systemd/namespace-@{rand6}/dev/,
mount options=(rw bind) /dev/** -> /tmp/namespace-dev-@{rand6}/**,
mount options=(rw bind) /dev/** -> @{run}/systemd/namespace-@{rand6}/dev/**,
mount options=(rw bind) @{run}/systemd/propagate/*/ -> @{run}/systemd/mount-rootfs/@{run}/systemd/incoming/,
mount options=(rw move) -> @{sys}/fs/fuse/connections/,
@ -90,6 +94,7 @@ profile systemd flags=(attach_disconnected,mediate_deleted) {
remount options=(ro nosuid nodev bind) /var/,
remount options=(ro nosuid nodev noexec bind) /boot/,
remount options=(ro nosuid nodev noexec bind) /dev/mqueue/,
remount options=(ro nosuid nodev noexec bind) /efi/,
remount options=(ro nosuid noexec bind) /dev/pts/,
umount /,

3
apparmor.d/groups/_full/systemd-user
View file

@ -30,6 +30,9 @@ profile systemd-user flags=(attach_disconnected,mediate_deleted) {
ptrace (read),
unix (bind) type=stream addr=@@{hex}/bus/systemd/bus-system,
unix (bind) type=stream addr=@@{hex}/bus/systemd/bus-api-user,
# dbus: own bus=session name=org.freedesktop.systemd1
@{exec_path} mr,