mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2025-01-18 08:58:15 +01:00
General updates
This commit is contained in:
Jeroen Rijken
Alex
parent
33da7af6e8
commit
465a31c638
9 changed files with 78 additions and 3 deletions
|
|
@ -1,5 +1,6 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
|
||||
# Copyright (C) 2022 Jeroen Rijken
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
|
@ -30,6 +31,14 @@ profile unattended-upgrade @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
signal (send) peer=apt-methods-http,
|
||||
|
||||
dbus send bus=system path=/org/freedesktop/PackageKit
|
||||
interface=org.freedesktop.PackageKit
|
||||
member=StateHasChanged,
|
||||
|
||||
dbus send bus=system path=/org/freedesktop/PackageKit
|
||||
interface=org.freedesktop.DBus.Introspectable
|
||||
member=Introspect,
|
||||
|
||||
dbus send bus=system path=/org/freedesktop/login[0-9]
|
||||
interface=org.freedesktop.login[0-9].Manager
|
||||
member=Inhibit,
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2017-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
|
||||
# Copyright (C) 2022 Jeroen Rijken
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
|
@ -33,6 +34,20 @@ profile pulseaudio @{exec_path} {
|
|||
network bluetooth stream,
|
||||
network bluetooth seqpacket,
|
||||
|
||||
dbus (send)
|
||||
bus=session
|
||||
path=/Client0/EntryGroup[0-9]*
|
||||
interface=org.freedesktop.Avahi.EntryGroup
|
||||
member={GetState,AddService,AddServiceSubtype,Commit}
|
||||
peer=(name=org.freedesktop.Avahi),
|
||||
|
||||
dbus (receive)
|
||||
bus=session
|
||||
path=/Client0/EntryGroup[0-9]*
|
||||
interface=org.freedesktop.Avahi.EntryGroup
|
||||
member={StateChanged}
|
||||
peer=(name=org.freedesktop.Avahi),
|
||||
|
||||
dbus (send)
|
||||
bus=session
|
||||
path=/org/freedesktop/DBus
|
||||
|
|
@ -84,6 +99,34 @@ profile pulseaudio @{exec_path} {
|
|||
member=GetManagedObjects
|
||||
peer=(name=org.bluez),
|
||||
|
||||
dbus (send)
|
||||
bus=system
|
||||
path=/
|
||||
interface=org.freedesktop.DBus.Peer
|
||||
member=Ping
|
||||
peer=(name=org.freedesktop.Avahi),
|
||||
|
||||
dbus (send)
|
||||
bus=system
|
||||
path=/
|
||||
interface=org.freedesktop.Avahi.Server
|
||||
member={GetAPIVersion,GetState,EntryGroupNew}
|
||||
peer=(name=org.freedesktop.Avahi),
|
||||
|
||||
dbus (receive)
|
||||
bus=system
|
||||
path=/
|
||||
interface=org.freedesktop.Avahi.Server
|
||||
member={StateChanged}
|
||||
peer=(name=org.freedesktop.Avahi),
|
||||
|
||||
dbus (send)
|
||||
bus=system
|
||||
path=/
|
||||
interface=org.freedesktop.hostname[0-9]*
|
||||
member={Get}
|
||||
peer=(name=/org/freedesktop/hostname1[0-9]*,
|
||||
|
||||
@{exec_path} mrix,
|
||||
|
||||
/{usr/,}@{libexec}/pulse/gsettings-helper mrix,
|
||||
|
|
|
|||
|
|
@ -1,5 +1,6 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
|
||||
# Copyright (C) 2022 Jeroen Rijken
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
|
@ -51,6 +52,10 @@ profile systemd-logind @{exec_path} flags=(attach_disconnected,complain) {
|
|||
interface=org.freedesktop.DBus.Properties
|
||||
member=PropertiesChanged,
|
||||
|
||||
dbus receive bus=system path=/
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=Get,
|
||||
|
||||
dbus bind bus=system
|
||||
name=org.freedesktop.login[0-9],
|
||||
|
||||
|
|
|
|||
|
|
@ -1,6 +1,7 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2019-2022 Mikhail Morfikov
|
||||
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
|
||||
# Copyright (C) 2022 Jeroen Rijken
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
|
@ -26,6 +27,8 @@ profile mount @{exec_path} flags=(complain) {
|
|||
network inet stream,
|
||||
network inet6 stream,
|
||||
|
||||
ptrace (read) peer=k3s,
|
||||
|
||||
signal (receive) set=(term, kill),
|
||||
|
||||
@{exec_path} mr,
|
||||
|
|
|
|||
|
|
@ -1,5 +1,6 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
|
||||
# Copyright (C) 2022 Jeroen Rijken
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
|
@ -11,6 +12,7 @@ profile newgidmap @{exec_path} {
|
|||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability dac_override,
|
||||
capability setgid,
|
||||
capability sys_admin,
|
||||
|
||||
|
|
|
|||
|
|
@ -1,5 +1,6 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
|
||||
# Copyright (C) 2022 Jeroen Rijken
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
|
@ -11,6 +12,7 @@ profile newuidmap @{exec_path} {
|
|||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability dac_override,
|
||||
capability setuid,
|
||||
capability sys_admin,
|
||||
|
||||
|
|
|
|||
|
|
@ -1,12 +1,13 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
|
||||
# Copyright (C) 2022 Jeroen Rijken
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/rngd
|
||||
@{exec_path} = /{usr/,}{s,}bin/rngd
|
||||
profile rngd @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/devices-usb>
|
||||
|
|
|
|||
|
|
@ -1,5 +1,6 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2018-2021 Mikhail Morfikov
|
||||
# Copyright (C) 2022 Jeroen Rijken
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
|
@ -17,6 +18,7 @@ profile smartd @{exec_path} {
|
|||
# Unable to register SCSI device /dev/disk/by-id/ata-* at line * of file /etc/smartd.conf
|
||||
# Device: /dev/disk/by-id/ata-*, not available
|
||||
capability sys_rawio,
|
||||
capability sys_admin,
|
||||
|
||||
# Needed?
|
||||
deny capability net_admin,
|
||||
|
|
@ -39,5 +41,7 @@ profile smartd @{exec_path} {
|
|||
/dev/ r,
|
||||
@{PROC}/devices r,
|
||||
|
||||
/run/systemd/notify rw,
|
||||
|
||||
include if exists <local/smartd>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -1,5 +1,6 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2015-2020 Mikhail Morfikov
|
||||
# Copyright (C) 2022 Jeroen Rijken
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
|
@ -9,9 +10,14 @@ include <tunables/global>
|
|||
@{exec_path} = /{usr/,}sbin/thermald
|
||||
profile thermald @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/dbus-strict>
|
||||
|
||||
capability sys_boot,
|
||||
|
||||
dbus (bind)
|
||||
bus=system
|
||||
name=org.freedesktop.thermald,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
owner @{run}/thermald/ rw,
|
||||
|
|
@ -50,11 +56,11 @@ profile thermald @{exec_path} {
|
|||
|
||||
@{sys}/devices/virtual/powercap/intel-rapl/ r,
|
||||
@{sys}/devices/virtual/powercap/intel-rapl/**/name r,
|
||||
@{sys}/devices/virtual/powercap/intel-rapl/intel-rapl:[0-9]*/ r,
|
||||
@{sys}/devices/virtual/powercap/intel-rapl/intel-rapl:[0-9]*/* r,
|
||||
@{sys}/devices/virtual/powercap/intel-rapl/intel-rapl:[0-9]*/{,*} r,
|
||||
@{sys}/devices/virtual/powercap/intel-rapl/intel-rapl:[0-9]*/constraint_*_time_window_us w,
|
||||
@{sys}/devices/virtual/powercap/intel-rapl/intel-rapl:[0-9]*/constraint_*_power_limit_uw w,
|
||||
@{sys}/devices/virtual/powercap/intel-rapl/intel-rapl:[0-9]*/enabled w,
|
||||
@{sys}/devices/virtual/powercap/intel-rapl/intel-rapl:[0-9]*/intel-rapl:[0-9]*:[0-9]*/{,*} r,
|
||||
|
||||
include if exists <local/thermald>
|
||||
}
|
||||
|
|
|
|||
Loading…
Reference in a new issue