mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-18 08:58:15 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Initial pacman profiles.

Browse source
This commit is contained in:
Alexandre Pujol 2021-08-22 15:38:14 +01:00
parent 020eb0daf6
commit 3c1a201e4a
Failed to generate hash of commit
12 changed files with 403 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

119
apparmor.d/groups/pacman/pacman Normal file
View file

@ -0,0 +1,119 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/pacman
profile pacman @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/disks-read>
include <abstractions/nameservice-strict>
include <abstractions/openssl>
include <abstractions/ssl_certs>
capability audit_write,
capability chown,
capability dac_override,
capability dac_read_search,
capability fowner,
capability fsetid,
capability net_admin,
capability setfcap,
capability setgid,
capability setuid,
capability sys_chroot,
capability sys_resource,
network inet stream,
network inet6 stream,
network inet dgram,
network inet6 dgram,
network netlink raw,
unix (receive) type=stream,
@{exec_path} mr,
/{usr/,}bin/gpg rCx -> gpg,
/{usr/,}bin/gpgconf rCx -> gpg,
/{usr/,}bin/gpgsm rCx -> gpg,
/{usr/,}{s,}bin/ldconfig rix,
/{usr/,}bin/{,ba}sh rix,
# Pacman hooks & install scripts
/{usr/,}bin/arch-audit rPx,
/{usr/,}bin/bootctl rPx,
/{usr/,}bin/env rix,
/{usr/,}bin/fc-cache rPx,
/{usr/,}bin/gdk-pixbuf-query-loaders rPx,
/{usr/,}bin/glib-compile-schemas rPx,
/{usr/,}bin/gtk-query-immodules-3.0 rPx,
/{usr/,}bin/install-info rPx,
/{usr/,}bin/killall rPx,
/{usr/,}bin/pacdiff rPx,
/{usr/,}bin/sysctl rPx,
/{usr/,}bin/systemctl rPx -> child-systemctl,
/{usr/,}bin/update-ca-trust rPx,
/{usr/,}bin/update-desktop-database rPx,
/{usr/,}bin/update-mime-database rPx,
/{usr/,}bin/vercmp rix,
/{usr/,}lib/dkms/alpm-hook rPx,
/{usr/,}lib/ghc-*/bin/ghc-pkg rix,
/{usr/,}lib/systemd/systemd-* rPx,
/{usr/,}lib/vlc/vlc-cache-gen rPx,
/usr/share/libalpm/scripts/* rPx,
# Install/update packages
/ r,
/boot/{,**} rwl,
/etc/{,**} rwl,
/opt/{,**} rwl,
/srv/{,**} rwl,
/usr/{,**} rwl,
/var/{,**} rwl,
# Read packages files
@{user_pkg_dirs}/**.pkg.tar.zst{,.sig} r,
owner /var/lib/pacman/{,**} rwl,
owner /tmp/alpm_*/{,**} rw,
owner /tmp/checkup-db-[0-9]*/sync/*.db.part rw,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/stat r,
owner @{PROC}/@{pid}/mounts r,
@{PROC}/sys/kernel/osrelease r,
@{PROC}/1/environ r,
@{run}/utmp rk,
# Silencer,
deny /tmp/ r,
deny @{HOME}/ r,
deny @{HOME}/@{XDG_PROJECTS_DIR}/** r,
profile gpg {
include <abstractions/base>
capability dac_read_search,
/{usr/,}bin/gpg mr,
/{usr/,}bin/gpgconf mr,
/{usr/,}bin/gpgsm mr,
/{usr/,}bin/dirmngr rix,
/{usr/,}bin/gpg-agent rix,
/{usr/,}bin/gpg-connect-agent rix,
@{HOME}/@{XDG_GPG_DIR}/*.conf r,
owner /etc/pacman.d/gnupg/ rw,
owner /etc/pacman.d/gnupg/** rwkl,
}
include if exists <local/pacman>
}

22
apparmor.d/groups/pacman/pacman-hook-dconf Normal file
View file

@ -0,0 +1,22 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /usr/share/libalpm/scripts/dconf-update
profile pacman-hook-dconf @{exec_path} {
include <abstractions/base>
@{exec_path} mr,
/{usr/,}bin/bash rix,
/{usr/,}bin/rm rix,
/{usr/,}bin/dconf rPx,
/etc/dconf/db/{,**} rw,
include if exists <local/pacman-hook-dconf>
}

19
apparmor.d/groups/pacman/pacman-hook-depmod Normal file
View file

@ -0,0 +1,19 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /usr/share/libalpm/scripts/depmod
profile pacman-hook-depmod @{exec_path} {
include <abstractions/base>
@{exec_path} mr,
/{usr/,}bin/bash rix,
/{usr/,}bin/depmod rPx,
include if exists <local/pacman-hook-depmod>
}

16
apparmor.d/groups/pacman/pacman-hook-dkms Normal file
View file

@ -0,0 +1,16 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}lib/dkms/alpm-hook
profile pacman-hook-dkms @{exec_path} {
include <abstractions/base>
@{exec_path} mr,
include if exists <local/pacman-hook-dkms>
}

23
apparmor.d/groups/pacman/pacman-hook-fontconfig Normal file
View file

@ -0,0 +1,23 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /usr/share/libalpm/scripts/40-fontconfig-config
profile pacman-hook-fontconfig @{exec_path} {
include <abstractions/base>
@{exec_path} mr,
/{usr/,}bin/bash rix,
/{usr/,}bin/ln rix,
/{usr/,}bin/rm rix,
/etc/fonts/conf.d/* rwl,
/usr/share/fontconfig/conf.default/* r,
include if exists <local/pacman-hook-fontconfig>
}

22
apparmor.d/groups/pacman/pacman-hook-gio Normal file
View file

@ -0,0 +1,22 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /usr/share/libalpm/scripts/gio-querymodules
profile pacman-hook-gio @{exec_path} {
include <abstractions/base>
@{exec_path} mr,
/{usr/,}bin/bash rix,
/{usr/,}bin/rmdir rix,
/{usr/,}bin/gio-querymodules rPx,
/{usr/,}lib/gio/modules/{,**} rw,
include if exists <local/pacman-hook-gio>
}

33
apparmor.d/groups/pacman/pacman-hook-gtk Normal file
View file

@ -0,0 +1,33 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /usr/share/libalpm/scripts/gtk-update-icon-cache
profile pacman-hook-gtk @{exec_path} {
include <abstractions/base>
capability dac_read_search,
@{exec_path} mr,
/{usr/,}bin/bash rix,
/{usr/,}bin/rm rix,
/{usr/,}bin/rmdir rix,
/{usr/,}bin/gtk-update-icon-cache rPx,
/{usr/,}bin/gtk4-update-icon-cache rPx,
/usr/share/icons/{,**} rw,
/dev/tty rw,
# Inherit Silencer
deny network inet6 stream,
deny network inet stream,
include if exists <local/pacman-hook-gtk>
}

38
apparmor.d/groups/pacman/pacman-hook-mkinitcpio-install Normal file
View file

@ -0,0 +1,38 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /usr/share/libalpm/scripts/mkinitcpio-install
profile pacman-hook-mkinitcpio-install @{exec_path} {
include <abstractions/base>
capability dac_read_search,
capability mknod,
@{exec_path} mr,
/{usr/,}bin/bash rix,
/{usr/,}bin/compgen rix,
/{usr/,}bin/install rix,
/{usr/,}bin/mkinitcpio rPx,
/{usr/,}bin/mv rix,
/{usr/,}bin/sed rix,
/usr/share/mkinitcpio/*.preset r,
/etc/mkinitcpio.d/{,**} r,
owner /boot/vmlinuz-* rw,
/dev/tty rw,
# Inherit Silencer
deny network inet6 stream,
deny network inet stream,
include if exists <local/pacman-hook-mkinitcpio-install>
}

32
apparmor.d/groups/pacman/pacman-hook-mkinitcpio-remove Normal file
View file

@ -0,0 +1,32 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /usr/share/libalpm/scripts/mkinitcpio-remove
profile pacman-hook-mkinitcpio-remove @{exec_path} {
include <abstractions/base>
@{exec_path} mr,
/{usr/,}bin/bash rix,
/{usr/,}bin/rm rix,
/{usr/,}bin/mv rix,
/usr/share/mkinitcpio/*.preset r,
/boot/vmlinuz-* rw,
/boot/initramfs-*.img rw,
/boot/initramfs-*-fallback.img rw,
/dev/tty rw,
# Inherit Silencer
deny network inet6 stream,
deny network inet stream,
include if exists <local/pacman-hook-mkinitcpio-remove>
}

30
apparmor.d/groups/pacman/pacman-hook-perl Normal file
View file

@ -0,0 +1,30 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /usr/share/libalpm/scripts/detect-old-perl-modules.sh
profile pacman-hook-perl @{exec_path} {
include <abstractions/base>
@{exec_path} mr,
/{usr/,}bin/perl rix,
/{usr/,}bin/bash rix,
/{usr/,}bin/find rix,
/{usr/,}bin/pacman rPx,
/{usr/,}bin/sed rix,
/{usr/,}lib/perl[0-9]*/{,**} r,
/dev/tty rw,
# Inherit silencer
deny network inet6 stream,
deny network inet stream,
include if exists <local/pacman-hook-perl>
}

39
apparmor.d/groups/pacman/pacman-hook-systemd Normal file
View file

@ -0,0 +1,39 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /usr/share/libalpm/scripts/systemd-hook
profile pacman-hook-systemd @{exec_path} {
include <abstractions/base>
capability dac_read_search,
@{exec_path} mr,
/{usr/,}bin/bash rix,
/{usr/,}bin/touch rix,
/{usr/,}bin/journalctl rPx,
/{usr/,}bin/systemctl rPx -> child-systemctl,
/{usr/,}bin/systemd-binfmt rPx,
/{usr/,}bin/systemd-detect-virt rPx,
/{usr/,}bin/systemd-hwdb rPx,
/{usr/,}bin/systemd-sysctl rPx,
/{usr/,}bin/systemd-sysusers rPx,
/{usr/,}bin/systemd-tmpfiles rPx,
/{usr/,}bin/udevadm rPx,
/usr/ rw,
/dev/tty rw,
# Inherit silencer
deny network inet6 stream,
deny network inet stream,
include if exists <local/pacman-hook-systemd>
}

11
apparmor.d/groups/pacman/pacman-key
View file

@ -14,7 +14,7 @@ profile pacman-key @{exec_path} {
/{usr/,}bin/basename rix,
/{usr/,}bin/gettext rix,
/{usr/,}bin/gpg rUx,
/{usr/,}bin/gpg rCx -> gpg,
/{usr/,}bin/pacman-conf rPx,
/{usr/,}bin/tput rix,
@ -23,5 +23,14 @@ profile pacman-key @{exec_path} {
/dev/tty rw,
profile gpg {
include <abstractions/base>
/{usr/,}bin/gpg mr,
/etc/pacman.d/gnupg/ rw,
/etc/pacman.d/gnupg/** rwkl,
}
include if exists <local/pacman-key>
}