mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2024-12-25 06:27:49 +01:00
feat: profiles and integration tests improvments.
Some checks failed
Ubuntu / check (push) Has been cancelled
Ubuntu / build (default, ubuntu-22.04) (push) Has been cancelled
Ubuntu / build (default, ubuntu-24.04) (push) Has been cancelled
Ubuntu / build (full-system-policy, ubuntu-22.04) (push) Has been cancelled
Ubuntu / build (full-system-policy, ubuntu-24.04) (push) Has been cancelled
Ubuntu / tests (push) Has been cancelled
Some checks failed
Ubuntu / check (push) Has been cancelled
Ubuntu / build (default, ubuntu-22.04) (push) Has been cancelled
Ubuntu / build (default, ubuntu-24.04) (push) Has been cancelled
Ubuntu / build (full-system-policy, ubuntu-22.04) (push) Has been cancelled
Ubuntu / build (full-system-policy, ubuntu-24.04) (push) Has been cancelled
Ubuntu / tests (push) Has been cancelled
This commit is contained in:
parent
b4bcb2f16e
commit
3538d672ed
15 changed files with 36 additions and 19 deletions
10
.github/workflows/main.yml
vendored
10
.github/workflows/main.yml
vendored
|
@ -15,6 +15,7 @@ jobs:
|
|||
|
||||
build:
|
||||
runs-on: ${{ matrix.os }}
|
||||
needs: check
|
||||
strategy:
|
||||
matrix:
|
||||
os:
|
||||
|
@ -93,7 +94,6 @@ jobs:
|
|||
sudo apt-get install -y \
|
||||
apparmor-profiles apparmor-utils \
|
||||
bats bats-support
|
||||
bash tests/requirements.sh
|
||||
|
||||
- name: Install apparmor.d
|
||||
run: |
|
||||
|
@ -101,6 +101,14 @@ jobs:
|
|||
sudo dpkg --install .pkg/apparmor.d_*_amd64.deb || true
|
||||
sudo systemctl restart apparmor.service
|
||||
|
||||
- name: Github Action specific requirements
|
||||
run: |
|
||||
bash tests/requirements.sh
|
||||
sudo systemctl restart ModemManager NetworkManager
|
||||
sudo systemctl restart polkit snapd
|
||||
sudo systemctl restart systemd-hostnamed systemd-logind
|
||||
sudo systemctl restart packagekit udisks2
|
||||
|
||||
- name: Run the bats integration tests
|
||||
run: |
|
||||
make bats
|
||||
|
|
|
@ -24,10 +24,11 @@
|
|||
|
||||
network netlink raw, # PAM
|
||||
|
||||
dbus send bus=system path=/org/freedesktop/login1
|
||||
interface=org.freedesktop.logi1.Manager
|
||||
member=CreateSession
|
||||
peer=(name=org.freedesktop.login1, label=systemd-logind),
|
||||
unix bind type=stream addr=@@{hex15}/bus/sudo/system,
|
||||
unix bind type=stream addr=@@{hex16}/bus/sudo/system,
|
||||
|
||||
#aa:dbus talk bus=system name=org.freedesktop.home1 label=systemd-homed
|
||||
#aa:dbus talk bus=system name=org.freedesktop.login1 label=systemd-logind
|
||||
|
||||
dbus (send receive) bus=session path=/org/freedesktop/systemd1
|
||||
interface=org.freedesktop.systemd.Manager
|
||||
|
|
|
@ -7,8 +7,10 @@
|
|||
|
||||
abi <abi/4.0>,
|
||||
|
||||
@{att}/@{run}/systemd/journal/dev-log w,
|
||||
@{att}/@{run}/systemd/journal/socket w,
|
||||
|
||||
deny /apparmor/.null rw,
|
||||
deny @{att}/apparmor/.null rw,
|
||||
|
||||
include if exists <abstractions/attached/base.d>
|
||||
|
|
|
@ -33,7 +33,7 @@ profile dbus-system flags=(attach_disconnected) {
|
|||
|
||||
ptrace (read) peer=@{p_systemd},
|
||||
|
||||
#aa:dbus own bus=system name=org.freedesktop.DBus
|
||||
#aa:dbus own bus=system name=org.freedesktop.DBus path=/{,org/freedesktop/DBus}
|
||||
|
||||
@{exec_path} mrix,
|
||||
|
||||
|
|
|
@ -128,10 +128,11 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) {
|
|||
@{run}/udev/data/+rfkill:* r,
|
||||
@{run}/udev/data/n@{int} r,
|
||||
|
||||
@{sys}/devices/**/uevent r,
|
||||
@{sys}/devices/virtual/net/{,**} r,
|
||||
@{sys}/devices/@{pci}/net/*/{,**} r,
|
||||
@{sys}/devices/@{pci}/usb@{int}/**/net/{,**} r,
|
||||
@{sys}/devices/**/@{uuid}/net/*/{,**} r,
|
||||
@{sys}/devices/**/uevent r,
|
||||
@{sys}/devices/virtual/net/{,**} r,
|
||||
|
||||
@{PROC}/@{pids}/stat r,
|
||||
@{PROC}/1/environ r,
|
||||
|
|
|
@ -12,6 +12,8 @@ profile netplan.script @{exec_path} flags=(attach_disconnected) {
|
|||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/python>
|
||||
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{lib}/netplan/generate rix,
|
||||
|
@ -25,12 +27,16 @@ profile netplan.script @{exec_path} flags=(attach_disconnected) {
|
|||
@{run}/NetworkManager/conf.d/10-globally-managed-devices.conf{,.@{rand6}} rw,
|
||||
@{run}/NetworkManager/system-connections/ rw,
|
||||
@{run}/NetworkManager/system-connections/netplan-*.nmconnection{,.@{rand6}} rw,
|
||||
@{run}/systemd/network/ r,
|
||||
@{run}/systemd/network/@{int}-netplan{,-*}.{network,link}{,.@{rand6}} rw,
|
||||
@{run}/systemd/system/ r,
|
||||
@{run}/systemd/system/netplan-* rw,
|
||||
@{run}/systemd/system/systemd-networkd-wait-online.service.d/ r,
|
||||
@{run}/systemd/system/systemd-networkd-wait-online.service.d/10-netplan.conf w,
|
||||
@{run}/systemd/system/systemd-networkd.service.wants/ rw,
|
||||
@{run}/systemd/system/systemd-networkd.service.wants/netplan-*.service rw,
|
||||
@{run}/udev/rules.d/ r,
|
||||
@{run}/udev/rules.d/90-netplan.rules{,.@{rand6}} rw,
|
||||
@{run}/udev/rules.d/@{int}-netplan{,-*}.rules{,.@{rand6}} rw,
|
||||
|
||||
profile udevadm {
|
||||
include <abstractions/base>
|
||||
|
|
|
@ -22,6 +22,7 @@ profile ssh-keygen @{exec_path} {
|
|||
owner @{HOME}/@{XDG_SSH_DIR}/*_*{,.pub} rw,
|
||||
|
||||
/tmp/snapd@{int}/*_*{,.pub} w,
|
||||
/tmp/snapd@{int}/*.key{,.pub} w,
|
||||
|
||||
/dev/tty@{int} rw,
|
||||
/dev/ttyS@{int} rw,
|
||||
|
|
|
@ -10,6 +10,7 @@ include <tunables/global>
|
|||
profile hostnamectl @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/bus/org.freedesktop.systemd1>
|
||||
include <abstractions/consoles>
|
||||
|
||||
capability net_admin,
|
||||
|
|
|
@ -35,6 +35,8 @@ profile systemd-homed @{exec_path} flags=(attach_disconnected) {
|
|||
mount options=(rw, rslave) -> @{run}/,
|
||||
mount /dev/dm-@{int} -> @{run}/systemd/user-home-mount/,
|
||||
|
||||
unix bind type=stream addr=@@{hex16}/bus/systemd-homed/system,
|
||||
|
||||
#aa:dbus own bus=system name=org.freedesktop.home1
|
||||
|
||||
@{exec_path} mr,
|
||||
|
@ -61,6 +63,7 @@ profile systemd-homed @{exec_path} flags=(attach_disconnected) {
|
|||
@{run}/systemd/home/{,**} rw,
|
||||
@{run}/systemd/userdb/io.systemd.home r,
|
||||
@{run}/systemd/user-home-mount/{,**} rw,
|
||||
@{run}/systemd/notify w,
|
||||
|
||||
@{sys}/bus/ r,
|
||||
@{sys}/fs/ r,
|
||||
|
|
|
@ -13,6 +13,8 @@ profile needrestart-apt-pinvoke @{exec_path} {
|
|||
include <abstractions/bus/org.freedesktop.login1>
|
||||
include <abstractions/consoles>
|
||||
|
||||
capability dac_read_search,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{sh_path} rix,
|
||||
|
|
|
@ -31,8 +31,6 @@ profile sudo @{exec_path} flags=(attach_disconnected) {
|
|||
signal (send) set=(winch) peer=pacman,
|
||||
signal (send) set=(winch, hup, term) peer=rpm,
|
||||
|
||||
unix bind type=stream addr=@@{hex16}/bus/sudo/system/,
|
||||
|
||||
@{bin}/@{shells} rUx,
|
||||
@{lib}/** PUx,
|
||||
/opt/*/** PUx,
|
||||
|
|
|
@ -7,6 +7,7 @@ load common
|
|||
|
||||
setup_file() {
|
||||
aa_setup
|
||||
skip
|
||||
}
|
||||
|
||||
# bats test_tags=homectl
|
||||
|
|
|
@ -7,7 +7,6 @@ load common
|
|||
|
||||
setup_file() {
|
||||
aa_setup
|
||||
skip
|
||||
}
|
||||
|
||||
# bats test_tags=snap
|
||||
|
|
|
@ -27,12 +27,6 @@ setup_file() {
|
|||
aa_check
|
||||
}
|
||||
|
||||
# bats test_tags=systemd-id128
|
||||
@test "systemd-id128: Print the identifier of the current service invocation (this is available in systemd services)" {
|
||||
systemd-id128 invocation-id
|
||||
aa_check
|
||||
}
|
||||
|
||||
# bats test_tags=systemd-id128
|
||||
@test "systemd-id128: Generate a new random identifier and print it as a UUID (five groups of digits separated by hyphens)" {
|
||||
systemd-id128 new --uuid
|
||||
|
|
|
@ -19,7 +19,7 @@ arch)
|
|||
;;
|
||||
debian | ubuntu | whonix)
|
||||
sudo apt-get install -y \
|
||||
cpuid dfc systemd-userdbd
|
||||
cpuid dfc systemd-userdbd systemd-homed tlp
|
||||
;;
|
||||
opensuse*)
|
||||
;;
|
||||
|
|
Loading…
Reference in a new issue