mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2025-01-29 22:35:15 +01:00
feat(profiles): initial version of some ubuntu related profiles.
This commit is contained in:
Alexandre Pujol
parent
b9552c3f66
commit
24cf14ff3a
6 changed files with 224 additions and 0 deletions
60
apparmor.d/groups/ubuntu/apport-gtk
Normal file
60
apparmor.d/groups/ubuntu/apport-gtk
Normal file
|
|
@ -0,0 +1,60 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /usr/share/apport/apport-gtk
|
||||
profile apport-gtk @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/apt-common>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability sys_ptrace,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/{usr/,}{s,}bin/killall5 rix,
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
/{usr/,}bin/apt-cache rPx,
|
||||
/{usr/,}bin/cut rix,
|
||||
/{usr/,}bin/dpkg rPx,
|
||||
/{usr/,}bin/gdb rCx -> gdb,
|
||||
/{usr/,}bin/grep rix,
|
||||
/{usr/,}bin/gsettings rPx,
|
||||
/{usr/,}bin/journalctl rPx,
|
||||
/{usr/,}bin/kmod rPx,
|
||||
/{usr/,}bin/ldd rix,
|
||||
/{usr/,}bin/lsb_release rPx -> lsb_release,
|
||||
/{usr/,}bin/md5sum rix,
|
||||
|
||||
/usr/share/apport/general-hooks/*.py r,
|
||||
|
||||
/etc/apport/blacklist.d/apport r,
|
||||
/etc/apport/blacklist.d/README.blacklist r,
|
||||
/etc/apport/crashdb.conf r,
|
||||
/etc/bash_completion.d/apport_completion r,
|
||||
/etc/cron.daily/apport r,
|
||||
/etc/default/apport r,
|
||||
/etc/init.d/apport r,
|
||||
/etc/logrotate.d/apport r,
|
||||
|
||||
/var/lib/dpkg/info/*.md5sums r,
|
||||
/var/log/installer/media-info r,
|
||||
|
||||
owner @{PROC}/@{pid}/cgroup r,
|
||||
@{PROC}/ r,
|
||||
@{PROC}/@{pids}/fd/ r,
|
||||
@{PROC}/@{pids}/cmdline r,
|
||||
@{PROC}/@{pids}/stat r,
|
||||
|
||||
profile gdb {
|
||||
include <abstractions/base>
|
||||
/{usr/,}bin/gdb mr,
|
||||
|
||||
}
|
||||
|
||||
include if exists <local/apport-gtk>
|
||||
}
|
||||
21
apparmor.d/groups/ubuntu/apt-esm-hook
Normal file
21
apparmor.d/groups/ubuntu/apt-esm-hook
Normal file
|
|
@ -0,0 +1,21 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}lib/ubuntu-advantage/apt-esm-hook
|
||||
profile apt-esm-hook @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/apt-common>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/{usr/,}bin/dpkg rPx,
|
||||
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
|
||||
include if exists <local/apt-esm-hook>
|
||||
}
|
||||
41
apparmor.d/groups/ubuntu/check-new-release-gtk
Normal file
41
apparmor.d/groups/ubuntu/check-new-release-gtk
Normal file
|
|
@ -0,0 +1,41 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}lib/ubuntu-release-upgrader/check-new-release-gtk
|
||||
profile check-new-release-gtk @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/apt-common>
|
||||
include <abstractions/dconf>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/python>
|
||||
include <abstractions/ssl_certs>
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/{usr/,}bin/dpkg rPx,
|
||||
/{usr/,}bin/ischroot rix,
|
||||
/{usr/,}bin/lsb_release rPx -> lsb_release,
|
||||
|
||||
/usr/share/distro-info/{,**} r,
|
||||
/usr/share/icons/{,**} r,
|
||||
/usr/share/themes/{,**} r,
|
||||
/usr/share/ubuntu-release-upgrader/{,**} r,
|
||||
/usr/share/update-manager/{,**} r,
|
||||
|
||||
/etc/update-manager/{,**} r,
|
||||
|
||||
owner @{user_cache_dirs}/update-manager-core/{,**} rw,
|
||||
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
||||
include if exists <local/check-new-release-gtk>
|
||||
}
|
||||
26
apparmor.d/groups/ubuntu/hwe-support-status
Normal file
26
apparmor.d/groups/ubuntu/hwe-support-status
Normal file
|
|
@ -0,0 +1,26 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/hwe-support-status
|
||||
profile hwe-support-status @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/apt-common>
|
||||
include <abstractions/python>
|
||||
include <abstractions/openssl>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/{usr/,}bin/dpkg rPx,
|
||||
/{usr/,}bin/lsb_release rPx -> lsb_release,
|
||||
|
||||
/usr/share/distro-info/{,**} r,
|
||||
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
|
||||
include if exists <local/hwe-support-status>
|
||||
}
|
||||
27
apparmor.d/groups/ubuntu/list-oem-metapackages
Normal file
27
apparmor.d/groups/ubuntu/list-oem-metapackages
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}lib/update-notifier/list-oem-metapackages
|
||||
profile list-oem-metapackages @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/python>
|
||||
include <abstractions/openssl>
|
||||
include <abstractions/apt-common>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/{usr/,}bin/dpkg rPx,
|
||||
/{usr/,}bin/ischroot rix,
|
||||
|
||||
@{sys}/devices/**/ r,
|
||||
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
@{PROC}/filesystems r,
|
||||
|
||||
include if exists <local/list-oem-metapackages>
|
||||
}
|
||||
49
apparmor.d/groups/ubuntu/update-manager
Normal file
49
apparmor.d/groups/ubuntu/update-manager
Normal file
|
|
@ -0,0 +1,49 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/update-manager
|
||||
profile update-manager @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/apt-common>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/python>
|
||||
include <abstractions/dconf>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/{usr/,}bin/dpkg rPx,
|
||||
/{usr/,}bin/hwe-support-status rPx,
|
||||
/{usr/,}bin/ischroot rix,
|
||||
/{usr/,}bin/lsb_release rPx -> lsb_release,
|
||||
/{usr/,}bin/snap rPUx,
|
||||
/{usr/,}bin/uname rix,
|
||||
/{usr/,}lib/apt/methods/http{,s} rPx,
|
||||
|
||||
/usr/share/applications/{,**} r,
|
||||
/usr/share/distro-info/{,**} r,
|
||||
/usr/share/icons/{,**} r,
|
||||
/usr/share/ubuntu-release-upgrader/{,**} r,
|
||||
/usr/share/update-manager/{,**} r,
|
||||
/usr/share/X11/{,**} r,
|
||||
|
||||
/etc/machine-id r,
|
||||
/etc/update-manager/{,**} r,
|
||||
|
||||
/var/lib/update-manager/{,**} rw,
|
||||
|
||||
owner @{user_cache_dirs}/update-manager-core/{,**} rw,
|
||||
|
||||
owner @{run}/user/@{uid}/dconf/ rw,
|
||||
owner @{run}/user/@{uid}/dconf/user rw,
|
||||
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
|
||||
include if exists <local/update-manager>
|
||||
}
|
||||
Loading…
Reference in a new issue