mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-18 08:58:15 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(profiles): add aptd profile.

Browse source
This commit is contained in:
Alexandre Pujol 2022-07-21 22:31:59 +01:00
parent 595a27560f
commit 58b96a7ba9
Failed to generate hash of commit
1 changed files with 26 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

34
apparmor.d/groups/apt/apt
View file

@ -7,7 +7,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{exec_path} = /{usr/,}bin/apt /{usr/,}bin/apt-get @{exec_path} = /{usr/,}bin/apt /{usr/,}bin/apt-get /{usr/,}{s,}bin/aptd
profile apt @{exec_path} flags=(attach_disconnected) { profile apt @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/apt-common> include <abstractions/apt-common>
@ -15,6 +15,8 @@ profile apt @{exec_path} flags=(attach_disconnected) {
include <abstractions/consoles> include <abstractions/consoles>
include <abstractions/nameservice-strict> include <abstractions/nameservice-strict>
include <abstractions/ssl_certs> include <abstractions/ssl_certs>
include <abstractions/openssl>
include <abstractions/python>
capability chown, capability chown,
capability dac_override, capability dac_override,
@ -31,14 +33,12 @@ profile apt @{exec_path} flags=(attach_disconnected) {
unix (receive, send) type=stream peer=(label=apt-esm-json-hook), unix (receive, send) type=stream peer=(label=apt-esm-json-hook),
dbus send bus=system path=/org/freedesktop/PackageKit dbus (send, receive) bus=system path=/org/debian/apt{,/transaction/[0-9a-f]*}
interface=org.freedesktop.DBus.Introspectable interface=org.{debian.apt*,freedesktop.DBus.{Properties,Introspectable}},
member=Introspect
peer=(name=org.freedesktop.PackageKit),
dbus send bus=system path=/org/freedesktop/PackageKit dbus send bus=system path=/org/freedesktop/PackageKit
interface=org.freedesktop.PackageKit interface=org.freedesktop.{DBus.Introspectable,PackageKit}
member=StateHasChanged member={StateHasChanged,Introspect}
peer=(name=org.freedesktop.PackageKit), peer=(name=org.freedesktop.PackageKit),
dbus send bus=system path=/org/freedesktop/login[0-9] dbus send bus=system path=/org/freedesktop/login[0-9]
@ -46,8 +46,22 @@ profile apt @{exec_path} flags=(attach_disconnected) {
member=Inhibit member=Inhibit
peer=(name=org.freedesktop.login[0-9]), peer=(name=org.freedesktop.login[0-9]),
dbus send bus=system path=/org/freedesktop/DBus
interface=org.freedesktop.DBus{,.Introspectable}
member={RequestName,GetConnectionUnixProcessID,Introspect}
peer=(name=org.freedesktop.DBus),
dbus send bus=system path=/org/freedesktop/PolicyKit1/Authority
interface=org.freedesktop.{DBus.Introspectable,PolicyKit1.Authority}
member={CheckAuthorization,Introspect},
dbus bind bus=system
name= org.debian.apt,
@{exec_path} mr, @{exec_path} mr,
/{usr/,}{s,}bin/ r,
/{usr/,}bin/{,ba,da}sh rix, /{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/{,e}grep rix, /{usr/,}bin/{,e}grep rix,
/{usr/,}bin/echo rix, /{usr/,}bin/echo rix,
@ -94,6 +108,8 @@ profile apt @{exec_path} flags=(attach_disconnected) {
# For changelogs # For changelogs
/{usr/,}bin/sensible-pager rCx -> pager, /{usr/,}bin/sensible-pager rCx -> pager,
/usr/share/xml/iso-codes/{,**} r,
/etc/apt/sources.list rwk, /etc/apt/sources.list rwk,
/etc/machine-id r, /etc/machine-id r,
/var/lib/dbus/machine-id r, /var/lib/dbus/machine-id r,
@ -125,8 +141,10 @@ profile apt @{exec_path} flags=(attach_disconnected) {
owner /tmp/apt.conf.* rw, owner /tmp/apt.conf.* rw,
owner /tmp/apt.data.* rw, owner /tmp/apt.data.* rw,
owner @{PROC}/@{pid}/fd/ r, @{PROC}/@{pids}/cmdline r,
@{PROC}/@{pids}/mountinfo r, @{PROC}/@{pids}/mountinfo r,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/mounts r,
/dev/ptmx rw, /dev/ptmx rw,