mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-18 00:48:10 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(apt): improve apt/dpkg integration with ubuntu.

Browse source
This commit is contained in:
Alexandre Pujol 2023-04-30 21:42:42 +01:00
parent b45987ee8c
commit 57e995e4be
Failed to generate hash of commit
6 changed files with 12 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
apparmor.d/groups/apt/apt
View file

@ -239,8 +239,9 @@ profile apt @{exec_path} flags=(attach_disconnected) {
/{usr/,}bin/systemd-tty-ask-password-agent rix, /{usr/,}bin/systemd-tty-ask-password-agent rix,
owner @{run}/systemd/ask-password/ rw,
owner @{run}/systemd/ask-password-block/* rw, owner @{run}/systemd/ask-password-block/* rw,
owner @{run}/systemd/ask-password/ rw,
owner @{run}/systemd/private rw,
@{PROC}/1/environ r, @{PROC}/1/environ r,
@{PROC}/1/sched r, @{PROC}/1/sched r,

2
apparmor.d/groups/apt/apt-systemd-daily
View file

@ -46,6 +46,8 @@ profile apt-systemd-daily @{exec_path} {
/etc/default/locale r, /etc/default/locale r,
/ r,
# The /daily_lock file is only used when the /var/lib/apt/daily_lock can be accessed. # The /daily_lock file is only used when the /var/lib/apt/daily_lock can be accessed.
#/daily_lock w, #/daily_lock w,
/var/lib/apt/daily_lock wk, /var/lib/apt/daily_lock wk,

5
apparmor.d/groups/apt/dpkg-deb
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov # Copyright (C) 2019-2021 Mikhail Morfikov
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>, abi <abi/3.0>,
@ -12,10 +13,8 @@ profile dpkg-deb @{exec_path} {
include <abstractions/consoles> include <abstractions/consoles>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
#capability sys_tty_config,
# For "mk-build-deps -i"
capability dac_override, capability dac_override,
capability dac_read_search,
@{exec_path} mr, @{exec_path} mr,

1
apparmor.d/groups/apt/dpkg-genbuildinfo
View file

@ -10,6 +10,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/dpkg-genbuildinfo @{exec_path} = /{usr/,}bin/dpkg-genbuildinfo
profile dpkg-genbuildinfo @{exec_path} flags=(complain) { profile dpkg-genbuildinfo @{exec_path} flags=(complain) {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles>
include <abstractions/perl> include <abstractions/perl>
# For "mk-build-deps -i" # For "mk-build-deps -i"

2
apparmor.d/groups/apt/dpkg-genchanges
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2020-2021 Mikhail Morfikov # Copyright (C) 2020-2021 Mikhail Morfikov
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>, abi <abi/3.0>,
@ -9,6 +10,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/dpkg-genchanges @{exec_path} = /{usr/,}bin/dpkg-genchanges
profile dpkg-genchanges @{exec_path} flags=(complain) { profile dpkg-genchanges @{exec_path} flags=(complain) {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles>
include <abstractions/perl> include <abstractions/perl>
@{exec_path} r, @{exec_path} r,

3
apparmor.d/groups/apt/dpkg-split
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov # Copyright (C) 2019-2021 Mikhail Morfikov
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>, abi <abi/3.0>,
@ -11,6 +12,8 @@ profile dpkg-split @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>
capability dac_read_search,
@{exec_path} mr, @{exec_path} mr,
# Do not strip env to avoid errors like the following: # Do not strip env to avoid errors like the following: