mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-12-26 06:58:00 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

feat(profile): restrict some access to @{PROC}/@{pid}.

Browse source
This commit is contained in:
Alexandre Pujol 2024-09-25 14:00:29 +01:00
parent 90a8e44d20
commit 28b32f1ae3
Failed to generate hash of commit
10 changed files with 31 additions and 22 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
apparmor.d/abstractions/app/chromium
View file

@ -182,14 +182,15 @@
@{PROC}/ r,
@{PROC}/@{pid}/fd/ r,
@{PROC}/@{pids}/stat r,
@{PROC}/@{pids}/statm r,
@{PROC}/@{pids}/task/@{tid}/stat r,
@{PROC}/@{pids}/task/@{tid}/status r,
@{PROC}/@{pid}/stat r,
@{PROC}/@{pid}/task/@{tid}/status r,
@{PROC}/pressure/{memory,cpu,io} r,
@{PROC}/sys/fs/inotify/max_user_watches r,
@{PROC}/sys/kernel/yama/ptrace_scope r,
@{PROC}/vmstat r,
owner @{PROC}/@{pid}/clear_refs w,
owner @{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/environ r,
owner @{PROC}/@{pid}/gid_map w,
owner @{PROC}/@{pid}/limits r,
owner @{PROC}/@{pid}/mem r,
@ -197,12 +198,11 @@
owner @{PROC}/@{pid}/mounts r,
owner @{PROC}/@{pid}/oom_{,score_}adj rw,
owner @{PROC}/@{pid}/setgroups w,
owner @{PROC}/@{pid}/statm r,
owner @{PROC}/@{pid}/task/ r,
owner @{PROC}/@{pid}/task/@{tid}/comm rw,
owner @{PROC}/@{pid}/task/@{tid}/stat r,
owner @{PROC}/@{pid}/uid_map w,
owner @{PROC}/@{pids}/clear_refs w,
owner @{PROC}/@{pids}/cmdline r,
owner @{PROC}/@{pids}/environ r,
owner @{PROC}/@{pids}/task/ r,
/dev/ r,
/dev/hidraw@{int} rw,

9
apparmor.d/groups/bus/dbus-accessibility
View file

@ -64,12 +64,13 @@ profile dbus-accessibility @{exec_path} flags=(attach_disconnected) {
@{sys}/kernel/security/apparmor/features/dbus/mask r,
@{sys}/module/apparmor/parameters/enabled r,
@{PROC}/@{pid}/attr/apparmor/current r,
@{PROC}/@{pid}/cgroup r,
@{PROC}/@{pid}/cmdline r,
@{PROC}/@{pid}/oom_score_adj r,
@{PROC}/1/cgroup r,
owner @{PROC}/@{pid}/attr/apparmor/current r,
owner @{PROC}/@{pid}/cgroup r,
owner @{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/mounts r,
owner @{PROC}/@{pid}/oom_score_adj r,
owner /dev/tty@{int} rw,

3
apparmor.d/groups/gnome/gnome-session-binary
View file

@ -91,9 +91,10 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
@{sys}/devices/**/{vendor,device} r,
@{PROC}/@{pid}/cgroup r,
@{PROC}/1/cgroup r,
@{PROC}/cmdline r,
@{PROC}/sys/net/ipv{4,6}/conf/all/disable_ipv{4,6} r,
owner @{PROC}/@{pid}/cgroup r,
owner @{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/loginuid r,

10
apparmor.d/groups/gnome/gnome-shell
View file

@ -347,23 +347,23 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected,mediate_deleted) {
@{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/session.slice/cpu.max r,
@{PROC}/ r,
@{PROC}/@{pid}/attr/current r,
@{PROC}/@{pid}/cgroup r,
@{PROC}/@{pid}/cmdline r,
@{PROC}/@{pid}/net/* r,
@{PROC}/@{pid}/stat r,
@{PROC}/@{pid}/task/@{tid}/stat r,
@{PROC}/@{pids}/cmdline r,
@{PROC}/1/cgroup r,
@{PROC}/cmdline r,
@{PROC}/sys/kernel/osrelease r,
@{PROC}/sys/net/ipv{4,6}/conf/all/disable_ipv{4,6} r,
@{PROC}/vmstat r,
owner @{PROC}/@{pid}/attr/current r,
owner @{PROC}/@{pid}/cgroup r,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/fdinfo/@{int} r,
owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/mounts r,
owner @{PROC}/@{pid}/stat r,
owner @{PROC}/@{pid}/task/@{pid}/cmdline r,
owner @{PROC}/@{pid}/task/@{tid}/comm rw,
owner @{PROC}/@{pid}/task/@{tid}/stat r,
/dev/input/event@{int} rw,
/dev/media@{int} rw,

3
apparmor.d/groups/gnome/gnome-software
View file

@ -117,10 +117,11 @@ profile gnome-software @{exec_path} {
@{sys}/module/nvidia/version r,
@{PROC}/@{pid}/cgroup r,
@{PROC}/@{pids}/mounts r,
@{PROC}/1/cgroup r,
@{PROC}/sys/fs/pipe-max-size r,
@{PROC}/sys/net/ipv6/conf/all/disable_ipv6 r,
owner @{PROC}/@{pid}/cgroup r,
owner @{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/fdinfo/@{int} r,
owner @{PROC}/@{pid}/stat r,

3
apparmor.d/groups/gnome/gsd-datetime
View file

@ -43,6 +43,9 @@ profile gsd-datetime @{exec_path} flags=(attach_disconnected) {
@{run}/systemd/sessions/@{int} r,
@{run}/systemd/users/@{uid} r,
@{PROC}/1/cgroup r,
owner @{PROC}/@{pid}/cgroup r,
owner @{PROC}/@{pid}/fdinfo/@{int} r,
owner @{PROC}/@{pid}/stat r,

3
apparmor.d/groups/gnome/gsd-sharing
View file

@ -41,7 +41,8 @@ profile gsd-sharing @{exec_path} flags=(attach_disconnected) {
@{run}/systemd/sessions/* r,
@{run}/systemd/users/@{uid} r,
@{PROC}/@{pid}/cgroup r,
@{PROC}/1/cgroup r,
owner @{PROC}/@{pid}/cgroup r,
owner /dev/tty@{int} rw,

3
apparmor.d/groups/gnome/org.gnome.NautilusPreviewer
View file

@ -43,9 +43,10 @@ profile org.gnome.NautilusPreviewer @{exec_path} {
@{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/*org.gnome.NautilusPreviewer.slice/*/memory.* r,
@{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/session.slice/dbus.service/memory.* r,
@{PROC}/1/cgroup r,
@{PROC}/devices r,
@{PROC}/@{pid}/cgroup r,
@{PROC}/zoneinfo r,
owner @{PROC}/@{pid}/cgroup r,
owner @{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/mounts r,
owner @{PROC}/@{pid}/stat r,

1
apparmor.d/profiles-a-f/alacarte
View file

@ -30,6 +30,7 @@ profile alacarte @{exec_path} {
owner @{tmp}/gdkpixbuf-xpm-tmp.@{rand6} rw,
owner @{PROC}/@{pid}/cgroup r,
owner @{PROC}/@{pid}/mounts r,
include if exists <local/alacarte>

2
apparmor.d/profiles-m-r/protonmail-bridge-core
View file

@ -44,8 +44,8 @@ profile protonmail-bridge-core @{exec_path} {
owner /var/tmp/etilqs_@{hex16} rw,
@{PROC}/ r,
@{PROC}/1/cgroup r,
@{PROC}/sys/net/core/somaxconn r,
@{PROC}/@{pid}/cgroup r,
deny @{bin}/pass x,
deny owner @{user_password_store_dirs}/** r,