mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-02-07 02:35:06 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

ssh: better keys & network access.

Browse source
This commit is contained in:
Alexandre Pujol 2021-04-03 23:26:09 +01:00
parent 093af6982b
commit 660921f57c
Failed to generate hash of commit
2 changed files with 14 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
apparmor.d/groups/ssh/ssh
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2021 Mikhail Morfikov # Copyright (C) 2021 Mikhail Morfikov
# 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>, abi <abi/3.0>,
@ -15,6 +16,9 @@ profile ssh @{exec_path} {
network inet stream, network inet stream,
network inet6 stream, network inet6 stream,
network inet dgram,
network inet6 dgram,
network netlink raw,
@{exec_path} mr, @{exec_path} mr,
@ -23,8 +27,8 @@ profile ssh @{exec_path} {
owner @{HOME}/@{XDG_SSH_DIR}/ r, owner @{HOME}/@{XDG_SSH_DIR}/ r,
owner @{HOME}/@{XDG_SSH_DIR}/config r, owner @{HOME}/@{XDG_SSH_DIR}/config r,
owner @{HOME}/@{XDG_SSH_DIR}/known_hosts r, owner @{HOME}/@{XDG_SSH_DIR}/known_hosts r,
owner @{HOME}/@{XDG_SSH_DIR}/*_rsa{,.pub} r, owner @{HOME}/@{XDG_SSH_DIR}/*_*{,.pub} r,
owner @{HOME}/@{XDG_SSH_DIR}/*_ed25519{,.pub} r, owner @{HOME}/@{XDG_PROJECTS_DIR}/**/ssh/{,*} r,
/etc/ssh/ssh_config r, /etc/ssh/ssh_config r,
/etc/ssh/ssh_config.d/ r, /etc/ssh/ssh_config.d/ r,

8
apparmor.d/groups/ssh/ssh-agent
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2018-2021 Mikhail Morfikov # Copyright (C) 2018-2021 Mikhail Morfikov
# 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>, abi <abi/3.0>,
@ -22,6 +23,11 @@ profile ssh-agent @{exec_path} {
/{usr/,}bin/sway rPUx, /{usr/,}bin/sway rPUx,
/{usr/,}bin/enlightenment_start rPUx, /{usr/,}bin/enlightenment_start rPUx,
# SSH keys
owner @{HOME}/@{XDG_SSH_DIR}/ rw,
owner @{HOME}/@{XDG_SSH_DIR}/* r,
owner @{HOME}/@{XDG_PROJECTS_DIR}/**/ssh/{,*} r,
# When started via systemd # When started via systemd
@{run}/user/[0-9]*/openssh_agent rw, @{run}/user/[0-9]*/openssh_agent rw,
@ -34,5 +40,7 @@ profile ssh-agent @{exec_path} {
owner /dev/tty[0-9]* rw, owner /dev/tty[0-9]* rw,
owner @{HOME}/.xsession-errors w, owner @{HOME}/.xsession-errors w,
@{run}/user/1000/keyring/.ssh rw,
include if exists <local/ssh-agent> include if exists <local/ssh-agent>
} }