mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-11-15 16:03:51 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat(full): improve fps setup.

Browse Source
This commit is contained in:
Alexandre Pujol 2024-01-25 22:42:29 +00:00
parent cc98c21cbf
commit 55ae6d2b75
No known key found for this signature in database
GPG Key ID: C5469996F0DF68EC
3 changed files with 16 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
apparmor.d/groups/_full/default
View File

@ -44,6 +44,8 @@ profile default @{exec_path} flags=(attach_disconnected,mediate_deleted) {
@{bin}/su rPx -> default-sudo, @{bin}/su rPx -> default-sudo,
@{bin}/sudo rPx -> default-sudo, @{bin}/sudo rPx -> default-sudo,
@{bin}/systemctl rix, @{bin}/systemctl rix,
@{coreutils_path} rix,
@{shells_path} rix,
@{bin}/less rPx -> child-pager, @{bin}/less rPx -> child-pager,
@{bin}/more rPx -> child-pager, @{bin}/more rPx -> child-pager,

19
apparmor.d/groups/_full/systemd
View File

@ -93,20 +93,18 @@ profile systemd flags=(attach_disconnected,mediate_deleted) {
# dbus: own bus=system name=org.freedesktop.systemd1 # dbus: own bus=system name=org.freedesktop.systemd1
@{bin}/systemctl rix, @{bin}/systemctl rix,
@{bin}/true rix,
@{lib}/systemd/systemd rix, # FIXME: AppArmorProfile=systemd-user, does not work with DE
@{bin}/{,ba,da}sh rPx -> systemd.service, @{lib}/systemd/systemd-executor rix,
@{bin}/chgrp rPx -> systemd.service, @{lib}/systemd/systemd rix, # FIXME: AppArmorProfile=systemd-user, does not work with DE
@{bin}/chmod rPx -> systemd.service, # Maybe: rPx -> systemd-user-gdm (in user@120.service.d)?
@{bin}/cp rPx -> systemd.service,
@{bin}/find rPx -> systemd.service,
@{bin}/install rPx -> systemd.service,
@{bin}/ldconfig rPx -> systemd.service, @{bin}/ldconfig rPx -> systemd.service,
@{bin}/mandb rPx -> systemd.service, @{bin}/mandb rPx -> systemd.service,
@{bin}/mkdir rPx -> systemd.service,
@{bin}/mount rPx -> systemd.service, @{bin}/mount rPx -> systemd.service,
@{bin}/savelog rPx -> systemd.service, @{bin}/savelog rPx -> systemd.service,
@{coreutils_path} rPx -> systemd.service,
@{shells_path} rPx -> systemd.service,
audit @{bin}/** Pix, audit @{bin}/** Pix,
audit @{lib}/** Pix, audit @{lib}/** Pix,
@ -193,6 +191,7 @@ profile systemd flags=(attach_disconnected,mediate_deleted) {
@{sys}/fs/**/ r, @{sys}/fs/**/ r,
@{sys}/fs/cgroup/{,**} rw, @{sys}/fs/cgroup/{,**} rw,
@{sys}/kernel/**/ r, @{sys}/kernel/**/ r,
@{sys}/module/**/uevent r,
@{sys}/module/apparmor/parameters/enabled r, @{sys}/module/apparmor/parameters/enabled r,
@{PROC}/@{pid}/{uid_map,gid_map} r, @{PROC}/@{pid}/{uid_map,gid_map} r,
@ -203,6 +202,7 @@ profile systemd flags=(attach_disconnected,mediate_deleted) {
@{PROC}/@{pid}/coredump_filter r, @{PROC}/@{pid}/coredump_filter r,
@{PROC}/@{pid}/environ r, @{PROC}/@{pid}/environ r,
@{PROC}/@{pid}/fd/ r, @{PROC}/@{pid}/fd/ r,
@{PROC}/@{pid}/fdinfo/@{int} r,
@{PROC}/@{pid}/gid_map w, @{PROC}/@{pid}/gid_map w,
@{PROC}/@{pid}/loginuid rw, @{PROC}/@{pid}/loginuid rw,
@{PROC}/@{pid}/mountinfo r, @{PROC}/@{pid}/mountinfo r,
@ -219,6 +219,7 @@ profile systemd flags=(attach_disconnected,mediate_deleted) {
@{PROC}/sys/kernel/* r, @{PROC}/sys/kernel/* r,
@{PROC}/sys/kernel/random/* rw, @{PROC}/sys/kernel/random/* rw,
@{PROC}/sys/net/ipv{4,6}/** rw, @{PROC}/sys/net/ipv{4,6}/** rw,
@{PROC}/sysvipc/{shm,sem,msg} r,
owner @{PROC}/@{pid}/oom_score_adj rw, owner @{PROC}/@{pid}/oom_score_adj rw,
/dev/ r, /dev/ r,

4
apparmor.d/groups/_full/systemd-user
View File

@ -27,10 +27,13 @@ profile systemd-user flags=(attach_disconnected,mediate_deleted) {
ptrace (read), ptrace (read),
signal (send) set=(term, cont, kill), signal (send) set=(term, cont, kill),
signal (receive) set=(hup) peer=@{systemd},
@{exec_path} mr, @{exec_path} mr,
@{bin}/systemctl rCx -> systemctl, @{bin}/systemctl rCx -> systemctl,
@{lib}/systemd/systemd-executor rix,
audit @{lib}/** Pix, audit @{lib}/** Pix,
audit @{bin}/** Pix, audit @{bin}/** Pix,
@ -76,6 +79,7 @@ profile systemd-user flags=(attach_disconnected,mediate_deleted) {
@{PROC}/sys/kernel/osrelease r, @{PROC}/sys/kernel/osrelease r,
@{PROC}/sys/kernel/pid_max r, @{PROC}/sys/kernel/pid_max r,
@{PROC}/sys/kernel/threads-max r, @{PROC}/sys/kernel/threads-max r,
owner @{PROC}/@{pid}/fdinfo/@{int} r,
owner @{PROC}/@{pids}/attr/apparmor/exec w, owner @{PROC}/@{pids}/attr/apparmor/exec w,
owner @{PROC}/@{pids}/fd/ r, owner @{PROC}/@{pids}/fd/ r,
owner @{PROC}/@{pids}/mountinfo r, owner @{PROC}/@{pids}/mountinfo r,