mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2025-02-20 08:55:34 +01:00
feat(profiles): general update.
This commit is contained in:
Alexandre Pujol
parent
3ff8e3847d
commit
558cb68f23
27 changed files with 155 additions and 150 deletions
|
|
@ -24,6 +24,7 @@
|
|||
/usr/share/dpkg/tupletable r,
|
||||
|
||||
/var/lib/dpkg/status r,
|
||||
/var/lib/ubuntu-advantage/apt-esm/{,**} r,
|
||||
|
||||
owner /tmp/clearsigned.message.* rw,
|
||||
owner /tmp/#[0-9]*[0-9] rw,
|
||||
|
|
|
|||
|
|
@ -29,6 +29,8 @@ profile command-not-found @{exec_path} {
|
|||
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
|
||||
/dev/tty[0-9]* rw,
|
||||
|
||||
# Silencer
|
||||
deny /usr/lib/ r,
|
||||
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@ profile networkd-dispatcher @{exec_path} {
|
|||
include <abstractions/python>
|
||||
include <abstractions/openssl>
|
||||
|
||||
dbus receive bus=system path=/org/freedesktop/network1/link/*
|
||||
dbus receive bus=system path=/org/freedesktop/network1{,/link/*}
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=PropertiesChanged
|
||||
peer=(name=:*),
|
||||
|
|
|
|||
|
|
@ -51,6 +51,7 @@ profile systemd-journald @{exec_path} {
|
|||
@{run}/udev/data/c4:[0-9]* r, # For TTY devices
|
||||
@{run}/udev/data/c10:[0-9]* r, # For non-serial mice, misc features
|
||||
@{run}/udev/data/c18[8-9]:[0-9]* r, # USB devices & USB serial converters
|
||||
@{run}/udev/data/c29:[0-9]* r, # For CD-ROM
|
||||
@{run}/udev/data/c23[4-9]:[0-9]* r, # For dynamic assignment range 234 to 254
|
||||
@{run}/udev/data/c24[0-9]:[0-9]* r,
|
||||
@{run}/udev/data/c25[0-4]:[0-9]* r,
|
||||
|
|
|
|||
|
|
@ -30,7 +30,7 @@ profile systemd-networkd @{exec_path} flags=(attach_disconnected,complain) {
|
|||
member=RequestName
|
||||
peer=(name=org.freedesktop.DBus),
|
||||
|
||||
dbus send bus=system path=/org/freedesktop/hostname[0-9]
|
||||
dbus send bus=system path=/org/freedesktop/hostname1
|
||||
interface=org.freedesktop.hostname1
|
||||
member=SetHostname
|
||||
peer=(name=org.freedesktop.hostname1),
|
||||
|
|
@ -39,7 +39,7 @@ profile systemd-networkd @{exec_path} flags=(attach_disconnected,complain) {
|
|||
interface=org.freedesktop.DBus.Properties
|
||||
member=Get,
|
||||
|
||||
dbus send bus=system path=/org/freedesktop/network[0-9]/link/*
|
||||
dbus send bus=system path=/org/freedesktop/network1{,/link/*}
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=PropertiesChanged
|
||||
peer=(name=org.freedesktop.DBus),
|
||||
|
|
@ -63,10 +63,9 @@ profile systemd-networkd @{exec_path} flags=(attach_disconnected,complain) {
|
|||
@{run}/systemd/notify rw,
|
||||
owner @{run}/systemd/netif/.#state rw,
|
||||
owner @{run}/systemd/netif/.#state* rw,
|
||||
owner @{run}/systemd/netif/leases/.#* rw,
|
||||
owner @{run}/systemd/netif/leases/[0-9]* rw,
|
||||
owner @{run}/systemd/netif/links/.#* rw,
|
||||
owner @{run}/systemd/netif/links/[0-9]* rw,
|
||||
owner @{run}/systemd/netif/leases/{,*} rw,
|
||||
owner @{run}/systemd/netif/links/{,*} rw,
|
||||
owner @{run}/systemd/netif/lldp/ rw,
|
||||
owner @{run}/systemd/netif/state rw,
|
||||
|
||||
@{run}/udev/data/n[0-9]* r,
|
||||
|
|
|
|||
|
|
@ -9,14 +9,25 @@ include <tunables/global>
|
|||
@{exec_path} = /{usr/,}lib/systemd/systemd-remount-fs
|
||||
profile systemd-remount-fs @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/systemd-common>
|
||||
|
||||
capability net_admin,
|
||||
capability sys_admin,
|
||||
capability sys_resource,
|
||||
|
||||
mount options=(rw, remount) -> /,
|
||||
mount options=(rw, remount) -> /proc/,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/{usr/,}bin/mount rix,
|
||||
|
||||
/etc/fstab r,
|
||||
|
||||
@{run}/host/container-manager r,
|
||||
|
||||
@{PROC}/ r,
|
||||
@{PROC}/1/cmdline r,
|
||||
|
||||
include if exists <local/systemd-remount-fs>
|
||||
|
|
|
|||
|
|
@ -15,6 +15,7 @@ profile systemd-sysctl @{exec_path} flags=(attach_disconnected) {
|
|||
capability net_admin,
|
||||
capability sys_admin,
|
||||
capability sys_ptrace,
|
||||
capability sys_rawio,
|
||||
# capability sys_resource,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
|
|
|||
|
|
@ -11,6 +11,10 @@ profile systemd-sysusers @{exec_path} flags=(attach_disconnected) {
|
|||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
|
||||
capability chown,
|
||||
capability fsetid,
|
||||
capability net_admin,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
# Config file locations
|
||||
|
|
|
|||
|
|
@ -22,5 +22,7 @@ profile release-upgrade-motd @{exec_path} {
|
|||
|
||||
/var/lib/ubuntu-release-upgrader/release-upgrade-available rw,
|
||||
|
||||
/dev/tty[0-9]* rw,
|
||||
|
||||
include if exists <local/release-upgrade-motd>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -27,6 +27,8 @@ profile update-motd-fsck-at-reboot @{exec_path} {
|
|||
|
||||
@{PROC}/uptime r,
|
||||
|
||||
/dev/tty[0-9]* rw,
|
||||
|
||||
profile mount {
|
||||
include <abstractions/base>
|
||||
|
||||
|
|
@ -41,6 +43,8 @@ profile update-motd-fsck-at-reboot @{exec_path} {
|
|||
|
||||
@{PROC}/@{pid}/mountinfo r,
|
||||
|
||||
/dev/tty[0-9]* rw,
|
||||
|
||||
}
|
||||
|
||||
include if exists <local/update-motd-fsck-at-reboot>
|
||||
|
|
|
|||
|
|
@ -39,6 +39,7 @@ profile update-motd-updates-available @{exec_path} {
|
|||
/etc/machine-id r,
|
||||
|
||||
/var/lib/update-notifier/{,*} rw,
|
||||
/var/lib/ubuntu-advantage/apt-esm/var/cache/apt/pkgcache.bin* rw,
|
||||
|
||||
/var/log/unattended-upgrades/unattended-upgrades-dpkg.log rw,
|
||||
|
||||
|
|
|
|||
|
|
@ -28,5 +28,7 @@ profile aa-log @{exec_path} {
|
|||
@{PROC}/sys/kernel/random/boot_id r,
|
||||
@{PROC}/sys/kernel/cap_last_cap r,
|
||||
|
||||
/dev/tty[0-9]* rw,
|
||||
|
||||
include if exists <local/aa-log>
|
||||
}
|
||||
|
|
@ -21,5 +21,7 @@ profile dumpe2fs @{exec_path} {
|
|||
owner @{run}/blkid/blkid.tab{,-*} rw,
|
||||
owner @{run}/blkid/blkid.tab.old rwl -> @{run}/blkid/blkid.tab,
|
||||
|
||||
/dev/tty[0-9]* rw,
|
||||
|
||||
include if exists <local/dumpe2fs>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -28,6 +28,7 @@ profile e2fsck @{exec_path} {
|
|||
owner @{user_img_dirs}/{,**} rwk,
|
||||
|
||||
@{run}/blkid/ rw,
|
||||
@{run}/systemd/fsck.progress rw,
|
||||
owner @{run}/blkid/blkid.tab.old rwl -> @{run}/blkid/blkid.tab,
|
||||
owner @{run}/blkid/blkid.tab{,-*} rw,
|
||||
|
||||
|
|
|
|||
|
|
@ -10,8 +10,14 @@ include <tunables/global>
|
|||
profile fail2ban-server @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/openssl>
|
||||
include <abstractions/python>
|
||||
|
||||
capability dac_read_search,
|
||||
capability net_admin,
|
||||
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
|
@ -27,8 +33,8 @@ profile fail2ban-server @{exec_path} flags=(attach_disconnected) {
|
|||
/var/log/auth.log r,
|
||||
/var/log/fail2ban.log w,
|
||||
|
||||
@{run}/fail2ban/fail2ban.pid w,
|
||||
@{run}/fail2ban/fail2ban.sock w,
|
||||
@{run}/fail2ban/fail2ban.pid rw,
|
||||
@{run}/fail2ban/fail2ban.sock rw,
|
||||
@{run}/resolvconf/resolv.conf r,
|
||||
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
|
|
|
|||
|
|
@ -11,6 +11,8 @@ include <tunables/global>
|
|||
profile gparted @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
ptrace (read),
|
||||
|
||||
@{exec_path} r,
|
||||
|
||||
/{usr/,}{s,}bin/ r,
|
||||
|
|
@ -34,8 +36,8 @@ profile gparted @{exec_path} {
|
|||
@{run}/udev/rules.d/ rw,
|
||||
@{run}/udev/rules.d/90-udisks-inhibit.rules rw,
|
||||
|
||||
/{usr/,}bin/udevadm rCx -> udevadm,
|
||||
/{usr/,}{s,}bin/killall5 rCx -> killall,
|
||||
/{usr/,}bin/udevadm rCx -> udevadm,
|
||||
/{usr/,}{s,}bin/killall5 rCx -> killall,
|
||||
|
||||
/{usr/,}bin/ps rPx,
|
||||
/{usr/,}bin/xhost rPx,
|
||||
|
|
@ -49,6 +51,9 @@ profile gparted @{exec_path} {
|
|||
/usr/local/bin/ r,
|
||||
/usr/local/sbin/ r,
|
||||
|
||||
@{PROC}/@{pids}/cmdline r,
|
||||
@{PROC}/@{pids}/stat r,
|
||||
|
||||
# file_inherit
|
||||
owner /dev/tty[0-9]* rw,
|
||||
|
||||
|
|
|
|||
|
|
@ -13,149 +13,93 @@ include <tunables/global>
|
|||
profile gpartedbin @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/dconf-write>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/disks-write>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/gtk>
|
||||
|
||||
# Needed to inform the system of newly created/removed partitions.
|
||||
# ioctl(3, BLKRRPART) = -1 EACCES (Permission denied)
|
||||
#
|
||||
# Error: Partition(s) * on /dev/sd* have been written, but we have been unable to inform the
|
||||
# kernel of the change, probably because it/they are in use. As a result, the old partition(s)
|
||||
# will remain in use. You should reboot now before making further changes.
|
||||
capability sys_admin,
|
||||
|
||||
#
|
||||
capability dac_read_search,
|
||||
|
||||
# Needed? (##FIXME##)
|
||||
capability sys_admin,
|
||||
capability sys_rawio,
|
||||
|
||||
# Needed?
|
||||
deny capability sys_nice,
|
||||
# deny capability sys_nice,
|
||||
|
||||
# Needed?
|
||||
ptrace (read),
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
||||
/{usr/,}{s,}bin/blkid rPx,
|
||||
/{usr/,}{s,}bin/dmidecode rPx,
|
||||
/{usr/,}{s,}bin/hdparm rPx,
|
||||
/{usr/,}{s,}bin/blkid rPx,
|
||||
/{usr/,}bin/kmod rPx,
|
||||
|
||||
/{usr/,}bin/udevadm rCx -> udevadm,
|
||||
/{usr/,}bin/mount rCx -> mount,
|
||||
/{usr/,}bin/umount rCx -> umount,
|
||||
/{usr/,}bin/mount rCx -> mount,
|
||||
/{usr/,}bin/udevadm rCx -> udevadm,
|
||||
/{usr/,}bin/umount rCx -> umount,
|
||||
|
||||
# RAID
|
||||
/{usr/,}{s,}bin/dmraid rPUx,
|
||||
|
||||
# Device mapper
|
||||
/{usr/,}{s,}bin/dmsetup rPUx,
|
||||
|
||||
# LVM
|
||||
/{usr/,}{s,}bin/dumpe2fs rPx,
|
||||
/{usr/,}{s,}bin/e2fsck rPx,
|
||||
/{usr/,}{s,}bin/e2image rPx,
|
||||
/{usr/,}{s,}bin/fsck.btrfs rPx,
|
||||
/{usr/,}{s,}bin/fsck.fat rPx,
|
||||
/{usr/,}{s,}bin/lvm rPUx,
|
||||
|
||||
# NTFS
|
||||
# The following tools link to mkntfs:
|
||||
# mkfs.ntfs
|
||||
/{usr/,}{s,}bin/mke2fs rPx,
|
||||
/{usr/,}{s,}bin/mkntfs rPx,
|
||||
/{usr/,}{s,}bin/mkswap rPx,
|
||||
/{usr/,}{s,}bin/ntfslabel rPx,
|
||||
/{usr/,}{s,}bin/ntfsresize rPx,
|
||||
/{usr/,}bin/ntfsinfo rPx,
|
||||
|
||||
# FAT16/32
|
||||
# The following tools link to mtools:
|
||||
# mattrib, mbadblocks, mcat, mcd, mclasserase, mcopy, mdel,
|
||||
# mdeltree, mdir, mdu, mformat, minfo, mlabel, mmd, mmount,
|
||||
# mmove, mpartition, mrd, mren, mshortname, mshowfat,
|
||||
# mtoolstest, mtype, mzip
|
||||
/{usr/,}bin/mtools rPx,
|
||||
# The following tools link to mkfs.fat:
|
||||
# mkdosfs, mkfs.msdos, mkfs.vfat
|
||||
/{usr/,}{s,}bin/mkfs.fat rPx,
|
||||
# The following tools link to fsck.fat:
|
||||
# dosfsck, fsck.msdos, fsck.vfat
|
||||
/{usr/,}{s,}bin/fsck.fat rPx,
|
||||
|
||||
# EXT2/3/4
|
||||
# The following tools link to mke2fs:
|
||||
# mkfs.ext2, mkfs.ext3, mkfs.ext4
|
||||
/{usr/,}{s,}bin/mke2fs rPx,
|
||||
# The following tools link to e2fsck:
|
||||
# fsck.ext2, fsck.ext3, fsck.ext4
|
||||
/{usr/,}{s,}bin/e2fsck rPx,
|
||||
/{usr/,}{s,}bin/resize2fs rPx,
|
||||
# The following tools link to dumpe2fs:
|
||||
# e2mmpstatus
|
||||
/{usr/,}{s,}bin/dumpe2fs rPx,
|
||||
# The following tools link to tune2fs:
|
||||
# e2label
|
||||
/{usr/,}{s,}bin/tune2fs rPx,
|
||||
/{usr/,}{s,}bin/e2image rPx,
|
||||
|
||||
# BTRFS
|
||||
/{usr/,}{s,}bin/mkfs.btrfs rPx,
|
||||
# The following tools link to btrfs:
|
||||
# btrfsck
|
||||
/{usr/,}bin/btrfs rPx,
|
||||
/{usr/,}bin/btrfstune rPx,
|
||||
/{usr/,}{s,}bin/fsck.btrfs rPx,
|
||||
/{usr/,}{s,}bin/mkfs.btrfs rPx,
|
||||
|
||||
# SWAP
|
||||
/{usr/,}{s,}bin/mkswap rPx,
|
||||
/{usr/,}{s,}bin/swaplabel rPx,
|
||||
/{usr/,}{s,}bin/swapon rPx,
|
||||
/{usr/,}{s,}bin/swapoff rPx,
|
||||
/{usr/,}{s,}bin/swapon rPx,
|
||||
/{usr/,}{s,}bin/tune2fs rPx,
|
||||
/{usr/,}bin/btrfs rPx,
|
||||
/{usr/,}bin/btrfstune rPx,
|
||||
/{usr/,}bin/mdadm rPUx,
|
||||
/{usr/,}bin/mkfs.* rPx,
|
||||
/{usr/,}bin/mtools rPx,
|
||||
/{usr/,}bin/ntfsinfo rPx,
|
||||
/{usr/,}bin/xfs_io rPUx,
|
||||
|
||||
/{usr/,}bin/xdg-open rCx -> open,
|
||||
/{usr/,}lib/@{multiarch}/glib-[0-9]*/gio-launch-desktop rCx -> open,
|
||||
/{usr/,}bin/xdg-open rCx -> child-open,
|
||||
/{usr/,}lib/@{multiarch}/glib-[0-9]*/gio-launch-desktop rCx -> child-open,
|
||||
|
||||
@{PROC}/version r,
|
||||
@{PROC}/swaps r,
|
||||
@{PROC}/partitions r,
|
||||
@{PROC}/devices r,
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
|
||||
/dev/mapper/control rw,
|
||||
|
||||
/etc/fstab r,
|
||||
|
||||
/var/lib/dbus/machine-id r,
|
||||
/etc/machine-id r,
|
||||
|
||||
@{run}/mount/utab r,
|
||||
|
||||
# For fsck of the btrfs filesystem
|
||||
owner /tmp/gparted-*/ rw,
|
||||
|
||||
# Started as root so without "owner".
|
||||
@{HOME}/.Xauthority r,
|
||||
|
||||
# For saving reports
|
||||
@{HOME}/.Xauthority r,
|
||||
owner @{HOME}/*.htm w,
|
||||
|
||||
owner /tmp/gparted-*/ rw,
|
||||
|
||||
@{run}/mount/utab r,
|
||||
|
||||
@{PROC}/devices r,
|
||||
@{PROC}/partitions r,
|
||||
@{PROC}/swaps r,
|
||||
@{PROC}/version r,
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
owner @{PROC}/@{pid}/mounts r,
|
||||
|
||||
/dev/mapper/control rw,
|
||||
|
||||
profile mount {
|
||||
include <abstractions/base>
|
||||
|
||||
capability sys_admin,
|
||||
|
||||
/{usr/,}bin/mount mr,
|
||||
|
||||
mount /dev/{s,v}d[a-z]*[0-9]* -> /tmp/gparted-*/,
|
||||
|
||||
mount /dev/{s,v}d[a-z]*[0-9]* -> /boot/,
|
||||
mount /dev/{s,v}d[a-z]*[0-9]* -> @{MOUNTS}/,
|
||||
mount /dev/{s,v}d[a-z]*[0-9]* -> @{MOUNTS}/*/,
|
||||
|
||||
/{usr/,}bin/mount mr,
|
||||
|
||||
@{sys}/devices/pci[0-9]*/**/block/{s,v}d[a-z]/ r,
|
||||
@{sys}/devices/pci[0-9]*/**/block/{s,v}d[a-z]/dev r,
|
||||
@{sys}/devices/pci[0-9]*/**/block/{s,v}d[a-z]/{s,v}d[a-z][0-9]*/ r,
|
||||
|
|
@ -171,24 +115,25 @@ profile gpartedbin @{exec_path} {
|
|||
|
||||
capability sys_admin,
|
||||
|
||||
/{usr/,}bin/umount mr,
|
||||
|
||||
umount /tmp/gparted-*/,
|
||||
|
||||
umount /boot/,
|
||||
umount @{MOUNTS}/,
|
||||
umount @{MOUNTS}/*/,
|
||||
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
/{usr/,}bin/umount mr,
|
||||
|
||||
owner @{run}/mount/ rw,
|
||||
owner @{run}/mount/utab{,.*} rw,
|
||||
owner @{run}/mount/utab.lock wk,
|
||||
|
||||
owner @{PROC}/@{pid}/mountinfo r,
|
||||
|
||||
}
|
||||
|
||||
profile udevadm {
|
||||
include <abstractions/base>
|
||||
include <abstractions/disks-write>
|
||||
|
||||
ptrace (read),
|
||||
|
||||
|
|
@ -196,42 +141,17 @@ profile gpartedbin @{exec_path} {
|
|||
|
||||
/etc/udev/udev.conf r,
|
||||
|
||||
owner @{PROC}/@{pid}/stat r,
|
||||
owner @{PROC}/@{pid}/cgroup r,
|
||||
@{PROC}/cmdline r,
|
||||
@{PROC}/1/sched r,
|
||||
@{PROC}/1/environ r,
|
||||
@{PROC}/1/sched r,
|
||||
@{PROC}/cmdline r,
|
||||
@{PROC}/sys/kernel/osrelease r,
|
||||
@{PROC}/sys/kernel/random/boot_id r,
|
||||
owner @{PROC}/@{pid}/cgroup r,
|
||||
owner @{PROC}/@{pid}/stat r,
|
||||
|
||||
# file_inherit
|
||||
include <abstractions/disks-write> # lots of files in this abstraction get inherited
|
||||
/dev/mapper/control rw,
|
||||
|
||||
}
|
||||
|
||||
profile open {
|
||||
include <abstractions/base>
|
||||
include <abstractions/xdg-open>
|
||||
|
||||
/{usr/,}bin/xdg-open mr,
|
||||
/{usr/,}lib/@{multiarch}/glib-[0-9]*/gio-launch-desktop mr,
|
||||
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
/{usr/,}bin/{m,g,}awk rix,
|
||||
/{usr/,}bin/readlink rix,
|
||||
/{usr/,}bin/basename rix,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
|
||||
owner @{run}/user/@{uid}/ r,
|
||||
|
||||
# Allowed apps to open
|
||||
|
||||
# file_inherit
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
||||
}
|
||||
|
||||
include if exists <local/gpartedbin>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -43,5 +43,7 @@ profile ip @{exec_path} flags=(attach_disconnected) {
|
|||
owner @{PROC}/@{pid}/net/igmp{,6} r,
|
||||
owner @{PROC}/sys/net/ipv{4,6}/route/flush w,
|
||||
|
||||
/dev/tty[0-9]* rw,
|
||||
|
||||
include if exists <local/ip>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -7,7 +7,7 @@ abi <abi/3.0>,
|
|||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/login
|
||||
profile login @{exec_path} flags=(complain) {
|
||||
profile login @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/authentication>
|
||||
include <abstractions/consoles>
|
||||
|
|
@ -28,6 +28,8 @@ profile login @{exec_path} flags=(complain) {
|
|||
|
||||
network netlink raw,
|
||||
|
||||
ptrace read,
|
||||
|
||||
dbus send bus=system path=/org/freedesktop/login1
|
||||
interface=org.freedesktop.login1.*
|
||||
peer=(name=org.freedesktop.login1),
|
||||
|
|
|
|||
|
|
@ -24,5 +24,9 @@ profile lsblk @{exec_path} {
|
|||
|
||||
@{run}/mount/utab r,
|
||||
|
||||
# File Inherit
|
||||
deny network inet stream,
|
||||
deny network inet6 stream,
|
||||
|
||||
include if exists <local/lsblk>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -13,6 +13,8 @@ profile lvm @{exec_path} {
|
|||
include <abstractions/dbus-strict>
|
||||
include <abstractions/disks-write>
|
||||
|
||||
capability dac_read_search,
|
||||
capability fowner,
|
||||
capability mknod,
|
||||
capability net_admin,
|
||||
capability sys_admin,
|
||||
|
|
@ -23,8 +25,9 @@ profile lvm @{exec_path} {
|
|||
|
||||
@{etc_rw}/lvm/** rwkl,
|
||||
|
||||
@{run}/lvm/** rwk,
|
||||
@{run}/lock/lvm/ rw,
|
||||
@{run}/lock/lvm/* rwk,
|
||||
@{run}/lvm/** rwk,
|
||||
|
||||
@{sys}/bus/ r,
|
||||
@{sys}/class/ r,
|
||||
|
|
|
|||
|
|
@ -9,8 +9,12 @@ include <tunables/global>
|
|||
@{exec_path} = /{usr/,}{s,}bin/nologin
|
||||
profile nologin @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
owner @{PROC}/@{pid}/loginuid r,
|
||||
|
||||
include if exists <local/nologin>
|
||||
}
|
||||
|
|
@ -30,8 +30,9 @@ profile pkttyagent @{exec_path} {
|
|||
|
||||
dbus receive bus=system path=/org/freedesktop/PolicyKit[0-9]/AuthenticationAgent
|
||||
interface=org.freedesktop.PolicyKit1.AuthenticationAgent
|
||||
member=BeginAuthentication,
|
||||
|
||||
member={BeginAuthentication,CancelAuthentication}
|
||||
peer=(name=:*, label=polkitd),
|
||||
|
||||
dbus receive bus=system path=/org/freedesktop/PolicyKit[0-9]/Authority
|
||||
interface=org.freedesktop.PolicyKit[0-9].Authority
|
||||
member=Changed,
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@ abi <abi/3.0>,
|
|||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/qemu-ga
|
||||
@{exec_path} = /{usr/,}{s,}bin/qemu-ga
|
||||
profile qemu-ga @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
|
|
|
|||
|
|
@ -116,7 +116,8 @@ profile run-parts @{exec_path} {
|
|||
/etc/kernel/prerm.d/dkms rCx -> kernel,
|
||||
|
||||
owner /tmp/#[0-9]*[0-9] rw,
|
||||
owner /tmp/file* rw,
|
||||
|
||||
/dev/tty[0-9]* rw,
|
||||
|
||||
profile motd {
|
||||
include <abstractions/base>
|
||||
|
|
@ -152,6 +153,7 @@ profile run-parts @{exec_path} {
|
|||
|
||||
@{PROC}/@{pids}/mounts r,
|
||||
|
||||
/dev/tty[0-9]* rw,
|
||||
}
|
||||
|
||||
profile kernel {
|
||||
|
|
|
|||
|
|
@ -26,6 +26,10 @@ profile snap @{exec_path} {
|
|||
member={StartTransientUnit,JobRemoved}
|
||||
peer=(name=:*, label=unconfined),
|
||||
|
||||
dbus (send, receive) bus=system path=/org/freedesktop/
|
||||
interface=org.freedesktop.systemd1.Manager
|
||||
member={StartTransientUnit,JobRemoved},
|
||||
|
||||
dbus send bus=session path=/org/freedesktop/portal/documents
|
||||
interface=org.freedesktop.portal.Documents
|
||||
member=GetMountPoint
|
||||
|
|
@ -35,6 +39,7 @@ profile snap @{exec_path} {
|
|||
|
||||
/{usr/,}bin/mount rix,
|
||||
|
||||
/{usr/,}bin/gpg{,2} rCx -> gpg,
|
||||
/{usr/,}bin/systemctl rPx -> child-systemctl,
|
||||
|
||||
/snap/{,**} rw,
|
||||
|
|
@ -77,5 +82,19 @@ profile snap @{exec_path} {
|
|||
|
||||
deny @{user_share_dirs}/gvfs-metadata/* r,
|
||||
|
||||
profile gpg {
|
||||
include <abstractions/base>
|
||||
|
||||
/{usr/,}bin/gpg{,2} mr,
|
||||
|
||||
/{usr/,}bin/dirmngr rix,
|
||||
/{usr/,}bin/gpg-agent rix,
|
||||
/{usr/,}bin/gpg-connect-agent rix,
|
||||
|
||||
owner @{HOME}/.snap/gnupg/ rw,
|
||||
owner @{HOME}/.snap/gnupg/** rwkl,
|
||||
|
||||
}
|
||||
|
||||
include if exists <local/snap>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -43,6 +43,11 @@ profile snapd @{exec_path} {
|
|||
ptrace (read) peer=snap,
|
||||
ptrace (read) peer=unconfined,
|
||||
|
||||
dbus (send) bus=system path=/org/freedesktop/
|
||||
interface=org.freedesktop.login1.Manager
|
||||
member={SetWallMessage,ScheduleShutdown}
|
||||
peer=(name=org.freedesktop.login1, label=systemd-logind),
|
||||
|
||||
dbus send bus=system path=/org/freedesktop/timedate1
|
||||
interface=org.freedesktop.DBus.Properties
|
||||
member=Get
|
||||
|
|
@ -151,6 +156,7 @@ profile snapd @{exec_path} {
|
|||
@{sys}/fs/cgroup/system.slice/{,**/} r,
|
||||
@{sys}/fs/cgroup/user.slice/ r,
|
||||
@{sys}/fs/cgroup/user.slice/user-@{uid}.slice/{,**/} r,
|
||||
@{sys}/kernel/kexec_loaded r,
|
||||
@{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r,
|
||||
@{sys}/kernel/security/apparmor/features/ r,
|
||||
@{sys}/kernel/security/apparmor/profiles r,
|
||||
|
|
|
|||
Loading…
Add table
Reference in a new issue