mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-11-15 07:54:17 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat(profile): rewrite update-ca-certificates.

Browse Source
This commit is contained in:
Alexandre Pujol 2023-10-20 23:43:36 +01:00
parent ed7585c3d0
commit 4276ede03c
No known key found for this signature in database
GPG Key ID: C5469996F0DF68EC
2 changed files with 17 additions and 66 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

82
apparmor.d/profiles-s-z/update-ca-certificates
View File

@ -14,29 +14,33 @@ profile update-ca-certificates @{exec_path} {
include <abstractions/openssl> include <abstractions/openssl>
include <abstractions/ssl_certs> include <abstractions/ssl_certs>
@{exec_path} r, @{exec_path} rmix,
@{bin}/{,ba,da}sh rix,
@{bin}/{,ba,da}sh rix,
@{bin}/basename rix, @{bin}/basename rix,
@{bin}/cat rix, @{bin}/cat rix,
@{bin}/chmod rix, @{bin}/chmod rix,
@{bin}/find rix, @{bin}/find rix,
@{bin}/flock rix, @{bin}/flock rix,
@{bin}/install rix,
@{bin}/ln rix, @{bin}/ln rix,
@{bin}/mktemp rix, @{bin}/mktemp rix,
@{bin}/mv rix, @{bin}/mv rix,
@{bin}/openssl rix,
@{bin}/readlink rix, @{bin}/readlink rix,
@{bin}/rm rix, @{bin}/rm rix,
@{bin}/sed rix, @{bin}/sed rix,
@{bin}/sort rix, @{bin}/sort rix,
@{bin}/test rix, @{bin}/test rix,
@{bin}/trust rix,
@{bin}/wc rix, @{bin}/wc rix,
@{bin}/openssl rix, @{lib}/ca-certificates/update.d/ r,
@{lib}/ca-certificates/update.d/* rix,
/etc/ca-certificates/update.d/ r, /etc/ca-certificates/update.d/ r,
/etc/ca-certificates/update.d/jks-keystore rCx -> jks-keystore, /etc/ca-certificates/update.d/* rix,
@{bin}/run-parts rCx -> run-parts,
/usr/share/p11-kit/modules/{,*} r,
/etc/ r, /etc/ r,
/etc/ca-certificates.conf r, /etc/ca-certificates.conf r,
@ -44,71 +48,17 @@ profile update-ca-certificates @{exec_path} {
/etc/ssl/certs/*.pem rw, /etc/ssl/certs/*.pem rw,
/etc/ssl/certs/@{hex}.[0-9] rw, /etc/ssl/certs/@{hex}.[0-9] rw,
@{lib}/locale/locale-archive r, /var/lib/ca-certificates/ rwk,
/var/lib/ca-certificates/** rw,
/ r,
/tmp/ r, /tmp/ r,
owner /tmp/ca-certificates{,.crt}.tmp.* rw, owner /tmp/ca-certificates{,.crt}.tmp.* rw,
# For shell pwd @{PROC}/filesystems r,
/root/ r,
/usr/local/share/ r, /dev/tty rw,
profile run-parts {
include <abstractions/base>
@{bin}/run-parts mr,
/etc/ca-certificates/update.d/ r,
# file_inherit
owner /dev/pts/@{int} rw,
}
profile jks-keystore {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/nameservice-strict>
include <abstractions/ssl_certs>
/etc/ca-certificates/update.d/jks-keystore mr,
@{lib}/ r,
@{lib}/jvm/java-[0-9]*-openjdk-*/jre/bin/java rix,
@{lib}/jvm/java-[0-9]*-openjdk-*/bin/java rix,
@{lib}/jvm/java-[0-9]*-openjdk-*/lib/server/classes.jsa mr,
@{bin}/{,ba,da}sh rix,
@{bin}/sed rix,
@{bin}/head rix,
@{bin}/mountpoint rix,
# Do not strip env to avoid errors like the following:
# ERROR: ld.so: object 'libfakeroot-sysv.so' from LD_PRELOAD cannot be preloaded (cannot open
# shared object file): ignored.
@{bin}/dpkg-query rpx,
#
@{bin}/dpkg rPx -> child-dpkg,
/usr/share/ca-certificates-java/ca-certificates-java.jar r,
/usr/share/java/java-atk-wrapper.jar r,
/etc/default/cacerts r,
/etc/ssl/certs/java/cacerts rw,
/etc/java-[0-9]*-openjdk/{,**} r,
owner @{PROC}/@{pid}/coredump_filter rw,
owner @{PROC}/@{pid}/coredump rw,
owner @{PROC}/@{pid}/cgroup r,
owner @{PROC}/@{pid}/mountinfo r,
@{sys}/fs/cgroup/** r,
owner /tmp/hsperfdata_*/ rw,
owner /tmp/hsperfdata_*/@{pid} rw,
}
include if exists <local/update-ca-certificates> include if exists <local/update-ca-certificates>
} }

1
dists/flags/main.flags
View File

@ -312,6 +312,7 @@ udisksctl complain
udisksd attach_disconnected,complain udisksd attach_disconnected,complain
umount complain umount complain
umount.udisks2 complain umount.udisks2 complain
update-ca-certificates complain
update-grub complain update-grub complain
update-secureboot-policy complain update-secureboot-policy complain
userdbctl complain userdbctl complain