mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-11-15 07:54:17 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

s3fs: rework the profile.

Browse Source
This commit is contained in:
Alexandre Pujol 2022-03-02 18:15:33 +00:00
parent 654b4e96b0
commit 28ee94c4a5
No known key found for this signature in database
GPG Key ID: C5469996F0DF68EC
1 changed files with 32 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

35
apparmor.d/profiles-s-z/s3fs
View File

@ -24,16 +24,45 @@ profile s3fs @{exec_path} {
@{exec_path} mr,
/{usr/,}bin/fusermount rPx,
/{usr/,}bin/fusermount{,3} rCx -> fusermount,
/etc/mime.types r,
/etc/passwd-s3fs r,
owner @{HOME}/.passwd-s3fs r,
owner /tmp/* rw,
@{PROC}/sys/kernel/random/boot_id r,
owner @{MOUNTS}/*/ r,
owner @{MOUNTS}/*/*/ r,
owner /tmp/* rw,
/dev/fuse rw,
profile fusermount {
include <abstractions/base>
include <abstractions/nameservice-strict>
capability sys_admin,
network inet stream,
network inet6 stream,
/{usr/,}bin/fusermount{,3} mr,
/etc/fuse.conf r,
@{MOUNTS}/*/ r,
@{MOUNTS}/*/*/ r,
mount fstype=fuse.s3fs -> @{MOUNTS}/*/,
mount fstype=fuse.s3fs -> @{MOUNTS}/*/*/,
umount @{MOUNTS}/*/,
umount @{MOUNTS}/*/*/,
@{PROC}/@{pids}/mounts r,
/dev/fuse rw,
}
include if exists <local/s3fs>
}