feat(profiles): general update.

This commit is contained in:
Alexandre Pujol 2023-05-07 20:34:00 +01:00
parent b740a1c3e6
commit 526dcc3252
Failed to generate hash of commit
14 changed files with 29 additions and 9 deletions

View file

@ -157,6 +157,7 @@ profile gnome-session-binary @{exec_path} flags=(attach_disconnected) {
/{usr/,}bin/aa-notify rPx, /{usr/,}bin/aa-notify rPx,
/{usr/,}bin/baloo_file rPx, /{usr/,}bin/baloo_file rPx,
@{libexec}/baloo_file rPx,
/{usr/,}bin/blueman-applet rPx, /{usr/,}bin/blueman-applet rPx,
/{usr/,}bin/firewall-applet rPUx, /{usr/,}bin/firewall-applet rPUx,
/{usr/,}bin/gnome-keyring-daemon rPx, /{usr/,}bin/gnome-keyring-daemon rPx,

View file

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = @{libexec}/tracker-extract-3 @{exec_path} = @{libexec}/tracker-extract-3
profile tracker-extract @{exec_path} { profile tracker-extract @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/dbus-session-strict> include <abstractions/dbus-session-strict>
include <abstractions/dconf-write> include <abstractions/dconf-write>

View file

@ -40,6 +40,7 @@ profile mullvad-daemon @{exec_path} flags=(attach_disconnected) {
"/opt/Mullvad VPN/resources/*" r, "/opt/Mullvad VPN/resources/*" r,
/etc/mullvad-vpn/{,*} r, /etc/mullvad-vpn/{,*} r,
/etc/mullvad-vpn/@{uid} rw,
/etc/mullvad-vpn/*.json rw, /etc/mullvad-vpn/*.json rw,
@{etc_rw}/resolv.conf rw, @{etc_rw}/resolv.conf rw,
@{etc_rw}/resolv.conf.mullvadbackup rw, @{etc_rw}/resolv.conf.mullvadbackup rw,

View file

@ -27,6 +27,7 @@ profile ssh @{exec_path} {
/{usr/,}bin/{,b,d,rb}ash rix, /{usr/,}bin/{,b,d,rb}ash rix,
/{usr/,}bin/{c,k,tc,z}sh rix, /{usr/,}bin/{c,k,tc,z}sh rix,
@{etc_ro}/ssh/ssh_config r,
@{etc_ro}/ssh/sshd_config r, @{etc_ro}/ssh/sshd_config r,
@{etc_ro}/ssh/sshd_config.d/{,*} r, @{etc_ro}/ssh/sshd_config.d/{,*} r,

View file

@ -7,16 +7,24 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}bin/systemd-machine-id-setup @{exec_path} = /{usr/,}bin/systemd-machine-id-setup
profile systemd-machine-id-setup @{exec_path} { profile systemd-machine-id-setup @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>
capability dac_override, capability dac_override,
capability setgid,
capability setuid,
capability sys_admin,
capability sys_chroot,
ptrace (read), ptrace (read),
mount /,
umount /etc/machine-id,
@{exec_path} mr, @{exec_path} mr,
/ r,
/etc/machine-id rw, /etc/machine-id rw,
/etc/ r, /etc/ r,
/var/ r, /var/ r,
@ -25,6 +33,7 @@ profile systemd-machine-id-setup @{exec_path} {
@{PROC}/cmdline r, @{PROC}/cmdline r,
@{PROC}/sys/kernel/osrelease r, @{PROC}/sys/kernel/osrelease r,
owner @{PROC}/@{pid}/stat r, owner @{PROC}/@{pid}/stat r,
owner @{PROC}/@{pid}/setgroups r,
include if exists <local/systemd-machine-id-setup> include if exists <local/systemd-machine-id-setup>
} }

View file

@ -18,7 +18,11 @@ profile systemd-sleep-grub @{exec_path} {
/etc/sysconfig/bootloader r, /etc/sysconfig/bootloader r,
/var/lib/nscd/passwd r,
@{PROC}/@{pid}/maps r, @{PROC}/@{pid}/maps r,
/dev/tty rw,
include if exists <local/systemd-sleep-grub> include if exists <local/systemd-sleep-grub>
} }

View file

@ -55,6 +55,7 @@ profile kmod @{exec_path} flags=(attach_disconnected) {
owner @{user_build_dirs}/**/lib/modules/*/kernel/{,**/} r, owner @{user_build_dirs}/**/lib/modules/*/kernel/{,**/} r,
owner @{user_build_dirs}/**/lib/modules/*/kernel/**/*.ko r, owner @{user_build_dirs}/**/lib/modules/*/kernel/**/*.ko r,
@{run}/xtables.lock r,
owner @{run}/tmpfiles.d/ w, owner @{run}/tmpfiles.d/ w,
owner @{run}/tmpfiles.d/static-nodes.conf w, owner @{run}/tmpfiles.d/static-nodes.conf w,

View file

@ -19,6 +19,7 @@ profile logrotate @{exec_path} flags=(attach_disconnected) {
capability fsetid, capability fsetid,
capability setgid, capability setgid,
capability setuid, capability setuid,
capability net_admin,
audit deny capability net_admin, audit deny capability net_admin,

View file

@ -54,6 +54,7 @@ profile mount @{exec_path} {
# Mount iso/img files # Mount iso/img files
owner @{user_img_dirs}/{,**} rwk, owner @{user_img_dirs}/{,**} rwk,
@{run}/ r,
owner @{run}/mount/ rw, owner @{run}/mount/ rw,
owner @{run}/mount/utab{,.*} rw, owner @{run}/mount/utab{,.*} rw,
owner @{run}/mount/utab.lock wk, owner @{run}/mount/utab.lock wk,

View file

@ -162,7 +162,7 @@ profile run-parts @{exec_path} {
/etc/lsb-release r, /etc/lsb-release r,
/etc/update-motd.d/[0-9]*-[a-z]* r, /etc/update-motd.d/[0-9]*-[a-z]* r,
/var/cache/motd-news r, /var/cache/motd-news rw,
/var/lib/update-notifier/updates-available r, /var/lib/update-notifier/updates-available r,
/var/lib/ubuntu-advantage/messages/motd-esm-announce r, /var/lib/ubuntu-advantage/messages/motd-esm-announce r,

View file

@ -23,7 +23,9 @@ profile slirp4netns @{exec_path} flags=(attach_disconnected) {
mount, mount,
umount, umount,
pivot_root oldroot=/tmp/old/ -> /tmp/, pivot_root /tmp/**,
pivot_root /tmp/old/,
# pivot_root oldroot=/tmp/old/ -> /tmp/,
@{exec_path} mr, @{exec_path} mr,
@ -34,9 +36,6 @@ profile slirp4netns @{exec_path} flags=(attach_disconnected) {
@{run}/user/@{uid}/netns/cni-* r, @{run}/user/@{uid}/netns/cni-* r,
owner @{run}/user/@{uid}/libpod/tmp/slirp4netns-*.log r, owner @{run}/user/@{uid}/libpod/tmp/slirp4netns-*.log r,
pivot_root /tmp/**,
pivot_root /tmp/old/,
/dev/net/tun rw, /dev/net/tun rw,
include if exists <local/slirp4netns> include if exists <local/slirp4netns>

View file

@ -78,7 +78,7 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted,complain)
/{usr/,}bin/uname rix, /{usr/,}bin/uname rix,
/{usr/,}bin/which rix, /{usr/,}bin/which rix,
/{usr/,}bin/xdg-icon-resource rPx, /{usr/,}bin/xdg-icon-resource rPx,
/{usr/,}bin/xdg-user-dir rPx, /{usr/,}bin/xdg-user-dir rix,
/{usr/,}bin/xz rix, /{usr/,}bin/xz rix,
/{usr/,}bin/zenity rix, /{usr/,}bin/zenity rix,
/{usr/,}lib{32,64}/ld-linux.so* rix, /{usr/,}lib{32,64}/ld-linux.so* rix,
@ -135,6 +135,7 @@ profile steam @{exec_path} flags=(attach_disconnected,mediate_deleted,complain)
owner @{user_config_dirs}/autostart/ r, owner @{user_config_dirs}/autostart/ r,
owner @{user_config_dirs}/cef_user_data/{,**} r, owner @{user_config_dirs}/cef_user_data/{,**} r,
owner @{user_config_dirs}/unity3d/{,**} rwk, owner @{user_config_dirs}/unity3d/{,**} rwk,
owner @{user_config_dirs}/user-dirs.dirs r,
owner @{user_share_dirs}/ r, owner @{user_share_dirs}/ r,
owner @{user_share_dirs}/applications/*.desktop w, owner @{user_share_dirs}/applications/*.desktop w,

View file

@ -87,6 +87,7 @@ profile sudo @{exec_path} {
@{PROC}/@{pids}/cgroup r, @{PROC}/@{pids}/cgroup r,
@{PROC}/@{pids}/fd/ r, @{PROC}/@{pids}/fd/ r,
@{PROC}/@{pids}/loginuid r,
@{PROC}/@{pids}/stat r, @{PROC}/@{pids}/stat r,
@{PROC}/1/limits r, @{PROC}/1/limits r,
@{PROC}/sys/kernel/seccomp/actions_avail r, @{PROC}/sys/kernel/seccomp/actions_avail r,