mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-11-14 23:43:56 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat(profile): add makepkg

Browse Source 
This profile is large enough to support any userbased compilation.
While giving protection as it only allows root access to use pacman.

see  #404, #420 #444, #466
This commit is contained in:
Alexandre Pujol 2024-09-09 20:18:30 +01:00
parent f31a68ca21
commit 51d8c052f5
No known key found for this signature in database
GPG Key ID: C5469996F0DF68EC
2 changed files with 76 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

75
apparmor.d/groups/pacman/makepkg Normal file
View File

@ -0,0 +1,75 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{bin}/makepkg
profile makepkg @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
network inet stream,
network inet6 stream,
network inet dgram,
network inet6 dgram,
network netlink raw,
file,
@{bin}/gpg{,2} Cx -> gpg,
@{bin}/gpgconf Cx -> gpg,
@{bin}/gpgsm Cx -> gpg,
@{bin}/sudo Cx -> sudo,
profile gpg {
include <abstractions/base>
include <abstractions/consoles>
@{bin}/gpg{,2} mr,
@{bin}/gpgconf mr,
@{bin}/gpgsm mr,
@{bin}/dirmngr rix,
@{bin}/gpg-agent rix,
@{bin}/gpg-connect-agent rix,
@{lib}/{,gnupg/}scdaemon rix,
/etc/pacman.d/gnupg/ r,
/etc/pacman.d/gnupg/** rwkl -> /etc/pacman.d/gnupg/**,
owner @{user_pkg_dirs}/{,**} rw,
owner @{HOME}/@{XDG_GPG_DIR}/ rw,
owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**,
owner @{run}/user/@{uid}/ r,
owner @{run}/user/@{uid}/gnupg/ r,
owner @{run}/user/@{uid}/gnupg/d.@{rand}/ rw,
owner @{run}/user/@{uid}/gnupg/d.@{rand}/S.scdaemon rw,
owner @{run}/user/@{uid}/gnupg/S.scdaemon rw,
owner @{PROC}/@{pid}/fd/ r,
include if exists <local/makepkg_gpg>
}
profile sudo {
include <abstractions/base>
include <abstractions/app/sudo>
capability sys_ptrace,
ptrace read,
@{bin}/pacman Px,
include if exists <local/makepkg_sudo>
}
include if exists <local/makepkg>
}
# vim:syntax=apparmor

2
apparmor.d/groups/pacman/pacman
View File

@ -168,7 +168,7 @@ profile pacman @{exec_path} flags=(attach_disconnected) {
@{bin}/gpg-connect-agent rix,
/etc/pacman.d/gnupg/ rw,
/etc/pacman.d/gnupg/** rwkl,
/etc/pacman.d/gnupg/** rwkl -> /etc/pacman.d/gnupg/**,
@{HOME}/@{XDG_GPG_DIR}/*.conf r,