mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-11-15 07:54:17 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Update profiles.

Browse Source
This commit is contained in:
Alexandre Pujol 2021-09-04 13:59:45 +01:00
parent c801bceab5
commit 6583a7bfb2
No known key found for this signature in database
GPG Key ID: C5469996F0DF68EC
26 changed files with 88 additions and 40 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
apparmor.d/groups/bus/ibus-dconf
View File

@ -20,8 +20,8 @@ profile ibus-dconf @{exec_path} flags=(attach_disconnected) {
/etc/dconf/db/ibus r,
/var/lib/dbus/machine-id r,
owner @{user_config_dirs}/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r,
/var/lib/gdm/.config/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r,
owner @{user_config_dirs}/ibus/bus/{,[0-9a-f]*-unix-wayland-[0-9]} r,
/var/lib/gdm/.config/ibus/bus/{,[0-9a-f]*-unix-wayland-[0-9]} r,
include <abstractions/dconf>
owner @{run}/user/@{uid}/dconf/ rw,

4
apparmor.d/groups/bus/ibus-engine-simple
View File

@ -16,8 +16,8 @@ profile ibus-engine-simple @{exec_path} flags=(attach_disconnected) {
/var/lib/dbus/machine-id r,
owner @{user_config_dirs}/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r,
/var/lib/gdm/.config/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r,
owner @{user_config_dirs}/ibus/bus/{,[0-9a-f]*-unix-wayland-[0-9]} r,
/var/lib/gdm/.config/ibus/bus/{,[0-9a-f]*-unix-wayland-[0-9]} r,
owner /dev/tty[0-9]* rw,

2
apparmor.d/groups/bus/ibus-extension-gtk3
View File

@ -30,7 +30,7 @@ profile ibus-extension-gtk3 @{exec_path} {
/var/lib/dbus/machine-id r,
owner @{user_config_dirs}/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r,
owner @{user_config_dirs}/ibus/bus/{,[0-9a-f]*-unix-wayland-[0-9]} r,
include <abstractions/dconf>
owner @{run}/user/@{uid}/dconf/ rw,

4
apparmor.d/groups/bus/ibus-portal
View File

@ -20,8 +20,8 @@ profile ibus-portal @{exec_path} flags=(attach_disconnected) {
/usr/share/locale/locale.alias r,
/var/lib/dbus/machine-id r,
/var/lib/gdm/.config/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r,
owner @{user_config_dirs}/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r,
/var/lib/gdm/.config/ibus/bus/{,[0-9a-f]*-unix-wayland-[0-9]} r,
owner @{user_config_dirs}/ibus/bus/{,[0-9a-f]*-unix-wayland-[0-9]} r,
owner /dev/tty[0-9]* rw,
/dev/null rw,

4
apparmor.d/groups/bus/ibus-x11
View File

@ -20,8 +20,8 @@ profile ibus-x11 @{exec_path} flags=(attach_disconnected) {
/var/lib/dbus/machine-id r,
owner @{user_config_dirs}/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r,
/var/lib/gdm/.config/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r,
owner @{user_config_dirs}/ibus/bus/{,[0-9a-f]*-unix-wayland-[0-9]} r,
/var/lib/gdm/.config/ibus/bus/{,[0-9a-f]*-unix-wayland-[0-9]} r,
owner @{run}/user/@{uid}/.mutter-Xwaylandauth.[0-9A-Z]* r,

1
apparmor.d/groups/gnome/gnome-control-center
View File

@ -81,6 +81,7 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
@{run}/udev/data/c13:[0-9]* r, # for /dev/input/*
@{run}/udev/data/c235:[0-9]* r,
@{run}/udev/data/c236:[0-9]* r,
@{run}/udev/data/c510:[0-9]* r,
@{run}/udev/data/n[0-9]* r,
@{sys}/bus/ r,

4
apparmor.d/groups/gnome/gnome-shell
View File

@ -69,9 +69,9 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
owner @{user_config_dirs}/.goutputstream{,*} rw,
owner @{user_config_dirs}/ibus/* r,
owner @{user_config_dirs}/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r,
owner @{user_config_dirs}/ibus/bus/{,[0-9a-f]*-unix-wayland-[0-9]} r,
owner @{user_config_dirs}/monitors.xml{,~} rwl,
/var/lib/gdm/.config/ibus/bus/[0-9a-f]*-unix-wayland-[0-9] r,
/var/lib/gdm/.config/ibus/bus/{,[0-9a-f]*-unix-wayland-[0-9]} r,
owner @{user_share_dirs}/backgrounds/{,**} rw,
owner @{user_share_dirs}/gnome-shell/{,**} rw,

1
apparmor.d/groups/gnome/tracker-extract
View File

@ -40,6 +40,7 @@ profile tracker-extract @{exec_path} {
@{run}/udev/data/c235:* r,
@{run}/udev/data/c236:* r,
@{run}/udev/data/c510:* r,
/dev/video[0-9]* rw,

2
apparmor.d/groups/gpg/gpg
View File

@ -14,6 +14,8 @@ profile gpg @{exec_path} {
include <abstractions/user-download-strict>
include <abstractions/nameservice-strict>
network netlink raw,
@{exec_path} mrix,
/{usr/,}bin/gpgconf rPx,

2
apparmor.d/groups/gvfs/gvfs-udisks2-volume-monitor
View File

@ -36,7 +36,7 @@ profile gvfs-udisks2-volume-monitor @{exec_path} {
# Mount points
@{MOUNTS}/*/ r,
@{MOUNTS}/*/*/ r,
@{MOUNTS}/*/**/ r,
@{HOME}/*/*/ r,
@{HOME}/*/*/**/ r,
@{HOME}/bluetooth/ r,

14
apparmor.d/groups/network/openvpn
View File

@ -65,7 +65,7 @@ profile openvpn @{exec_path} {
@{run}/NetworkManager/nm-openvpn-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* rw,
/{usr/,}bin/ip rix,
/{usr/,}bin/systemd-ask-password rCx -> systemd-ask-password,
/{usr/,}bin/systemd-ask-password rPx,
/{usr/,}lib/nm-openvpn-service-openvpn-helper rPx,
/etc/openvpn/force-user-traffic-via-vpn.sh rCx -> force-user-traffic-via-vpn,
/etc/openvpn/update-resolv-conf{,.sh} rCx -> update-resolv,
@ -74,18 +74,6 @@ profile openvpn @{exec_path} {
owner @{PROC}/@{pid}/net/route r,
profile systemd-ask-password {
include <abstractions/base>
include <abstractions/consoles>
/{usr/,}bin/systemd-ask-password mr,
@{PROC}/filesystems r,
owner @{PROC}/@{pid}/stat r,
}
profile update-resolv {
include <abstractions/base>
include <abstractions/consoles>

2
apparmor.d/groups/pacman/paccache
View File

@ -20,7 +20,7 @@ profile paccache @{exec_path} {
/{usr/,}bin/cat rix,
/{usr/,}bin/gawk rix,
/{usr/,}bin/gettext rix,
/{usr/,}bin/pacman rPUx,
/{usr/,}bin/pacman rPx,
/{usr/,}bin/pacman-conf rPx,
/{usr/,}bin/pacsort rix,
/{usr/,}bin/rm rix,

1
apparmor.d/groups/pacman/pacman
View File

@ -55,6 +55,7 @@ profile pacman @{exec_path} {
/{usr/,}bin/install-info rPx,
/{usr/,}bin/killall rPx,
/{usr/,}bin/pacdiff rPx,
/{usr/,}bin/pacman-key rPx,
/{usr/,}bin/sysctl rPx,
/{usr/,}bin/systemctl rPx -> child-systemctl,
/{usr/,}bin/update-ca-trust rPx,

6
apparmor.d/groups/pacman/pacman-hook-dconf
View File

@ -18,5 +18,11 @@ profile pacman-hook-dconf @{exec_path} {
/etc/dconf/db/{,**} rw,
/dev/tty rw,
# Inherit Silencer
deny network inet6 stream,
deny network inet stream,
include if exists <local/pacman-hook-dconf>
}

4
apparmor.d/groups/pacman/pacman-hook-depmod
View File

@ -15,5 +15,9 @@ profile pacman-hook-depmod @{exec_path} {
/{usr/,}bin/bash rix,
/{usr/,}bin/depmod rPx,
# Inherit Silencer
deny network inet6 stream,
deny network inet stream,
include if exists <local/pacman-hook-depmod>
}

6
apparmor.d/groups/pacman/pacman-hook-dkms
View File

@ -12,5 +12,11 @@ profile pacman-hook-dkms @{exec_path} {
@{exec_path} mr,
/{usr/,}bin/kmod rPx,
# Inherit Silencer
deny network inet6 stream,
deny network inet stream,
include if exists <local/pacman-hook-dkms>
}

9
apparmor.d/groups/pacman/pacman-hook-gio
View File

@ -16,7 +16,14 @@ profile pacman-hook-gio @{exec_path} {
/{usr/,}bin/rmdir rix,
/{usr/,}bin/gio-querymodules rPx,
/{usr/,}lib/gio/modules/{,**} rw,
/{usr/,}lib/gio/modules/giomodule.cache{,.[0-9A-Z]*} rw,
/{usr/,}lib/gtk-{3,4}.0/**/*/ rw,
/dev/tty rw,
# Inherit Silencer
deny network inet6 stream,
deny network inet stream,
include if exists <local/pacman-hook-gio>
}

4
apparmor.d/groups/pacman/pacman-hook-mkinitcpio-install
View File

@ -13,6 +13,8 @@ profile pacman-hook-mkinitcpio-install @{exec_path} {
capability dac_read_search,
capability mknod,
unix (receive) type=stream,
@{exec_path} mr,
/{usr/,}bin/bash rix,
@ -25,7 +27,9 @@ profile pacman-hook-mkinitcpio-install @{exec_path} {
/usr/share/mkinitcpio/*.preset r,
/etc/mkinitcpio.d/{,**} r,
/etc/mkinitcpio.d/*.preset rw,
/ r,
owner /boot/vmlinuz-* rw,
/dev/tty rw,

3
apparmor.d/groups/pacman/pacman-hook-perl
View File

@ -10,6 +10,9 @@ include <tunables/global>
profile pacman-hook-perl @{exec_path} {
include <abstractions/base>
capability dac_read_search,
capability mknod,
@{exec_path} mr,
/{usr/,}bin/perl rix,

18
apparmor.d/groups/pacman/pacman-hook-systemd
View File

@ -17,15 +17,15 @@ profile pacman-hook-systemd @{exec_path} {
/{usr/,}bin/bash rix,
/{usr/,}bin/touch rix,
/{usr/,}bin/journalctl rPx,
/{usr/,}bin/systemctl rPx -> child-systemctl,
/{usr/,}bin/systemd-binfmt rPx,
/{usr/,}bin/systemd-detect-virt rPx,
/{usr/,}bin/systemd-hwdb rPx,
/{usr/,}bin/systemd-sysctl rPx,
/{usr/,}bin/systemd-sysusers rPx,
/{usr/,}bin/systemd-tmpfiles rPx,
/{usr/,}bin/udevadm rPx,
/{usr/,}bin/journalctl rPx,
/{usr/,}bin/systemctl rPx -> child-systemctl,
/{usr/,}bin/systemd-binfmt rPx,
/{usr/,}bin/systemd-detect-virt rPx,
/{usr/,}bin/systemd-hwdb rPx,
/{usr/,}bin/systemd-sysusers rPx,
/{usr/,}bin/systemd-tmpfiles rPx,
/{usr/,}bin/udevadm rPx,
/{usr/,}lib/systemd/systemd-sysctl rPx,
/usr/ rw,

20
apparmor.d/groups/systemd/systemd-ask-password Normal file
View File

@ -0,0 +1,20 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/systemd-ask-password
profile systemd-ask-password @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
@{exec_path} mr,
@{PROC}/filesystems r,
owner @{PROC}/@{pid}/stat r,
include if exists <local/systemd-ask-password>
}

1
apparmor.d/profiles-a-l/browserpass
View File

@ -23,6 +23,7 @@ profile browserpass @{exec_path} flags=(attach_disconnected) {
owner @{user_cache_dirs}/mozilla/firefox/[0-9a-z]*.default/startupCache/scriptCache-*.bin r,
owner @{user_cache_dirs}/mozilla/firefox/[0-9a-z]*.default/startupCache/startupCache.*.little r,
owner @{user_cache_dirs}/mozilla/firefox/[0-9a-z]*.default/safebrowsing-updating/google[0-9]/goog-phish-proto-[0-9]*.vlpset rw,
owner /tmp/mozilla-temp-[0-9]* r,
@{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r,

1
apparmor.d/profiles-a-l/gio-querymodules
View File

@ -14,6 +14,7 @@ profile gio-querymodules @{exec_path} {
@{exec_path} mr,
/{usr/,}lib/gtk-{3,4}.0/**/giomodule.cache{,.[0-9A-Z]*} w,
/{usr/,}lib/gio/modules/giomodule.cache{,.[0-9A-Z]*} w,
include if exists <local/gio-querymodules>
}

5
apparmor.d/profiles-a-l/kmod
View File

@ -24,6 +24,9 @@ profile kmod @{exec_path} {
# than to standard error.
capability syslog,
# Needed for static-nodes
capability dac_override,
unix (receive) type=stream,
@{exec_path} mr,
@ -45,8 +48,6 @@ profile kmod @{exec_path} {
# Initframs
owner /tmp/mkinitcpio.*/{,**} rw,
# Needed for static-nodes
#capability dac_override,
#owner @{PROC}/@{pid}/fd/1 w,
# For local kernel build

1
apparmor.d/profiles-m-z/run-parts
View File

@ -25,6 +25,7 @@ profile run-parts @{exec_path} {
/etc/kernel/postinst.d/apt-auto-removal rCx -> kernel-pre-post,
/etc/kernel/postinst.d/dkms rCx -> kernel-pre-post,
/etc/kernel/postinst.d/initramfs-tools rCx -> kernel-pre-post,
/etc/kernel/postinst.d/unattended-upgrades rCx -> kernel-pre-post,
/etc/kernel/postinst.d/zz-update-grub rCx -> kernel-pre-post,
/etc/kernel/postrm.d/ r,

5
apparmor.d/profiles-m-z/update-initramfs
View File

@ -19,13 +19,14 @@ profile update-initramfs @{exec_path} {
/{usr/,}sbin/ r,
/{usr/,}bin/cat rix,
/{usr/,}bin/gawk rix,
/{usr/,}bin/getopt rix,
/{usr/,}bin/ischroot rix,
/{usr/,}bin/gawk rix,
/{usr/,}bin/ln rix,
/{usr/,}bin/mawk rix,
/{usr/,}bin/mv rix,
/{usr/,}bin/rm rix,
/{usr/,}bin/cat rix,
/{usr/,}bin/sha1sum rix,
/{usr/,}bin/sync rix,
/{usr/,}bin/uname rix,