mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-11-14 23:43:56 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat: update profiles.

Browse Source
This commit is contained in:
Alexandre Pujol 2022-03-30 22:20:56 +01:00
parent 9d40327b00
commit 6d1fa42f25
No known key found for this signature in database
GPG Key ID: C5469996F0DF68EC
19 changed files with 44 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
apparmor.d/groups/desktop/at-spi-bus-launcher
View File

@ -33,7 +33,7 @@ profile at-spi-bus-launcher @{exec_path} flags=(attach_disconnected) {
owner @{HOME}/.Xauthority r,
owner @{HOME}/.xsession-errors w,
owner @{run}/user/@{uid}/at-spi/ w,
owner @{run}/user/@{uid}/at-spi/{,bus} rw,
owner @{run}/user/@{uid}/dconf/ rw,
owner @{run}/user/@{uid}/dconf/user rw,
owner @{run}/user/@{uid}/gdm/Xauthority r,

1
apparmor.d/groups/desktop/xwayland
View File

@ -31,6 +31,7 @@ profile xwayland @{exec_path} flags=(attach_disconnected) {
owner @{run}/user/@{uid}/.mutter-Xwaylandauth.[a-zA-z0-9]* rw,
@{sys}/bus/pci/devices/ r,
@{sys}/devices/pci[0-9]*/**/revision r,
@{PROC}/@{pids}/cmdline r,
owner @{PROC}/@{pids}/comm r,

1
apparmor.d/groups/gnome/gnome-shell
View File

@ -156,6 +156,7 @@ profile gnome-shell @{exec_path} flags=(attach_disconnected) {
@{sys}/devices/pci[0-9]*/**/drm/ r,
@{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/gt_*_mhz r,
@{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/**/id r,
@{sys}/devices/pci[0-9]*/**/revision r,
owner @{PROC}/@{pid}/comm r,
owner @{PROC}/@{pid}/fd/ r,

1
apparmor.d/groups/gnome/tracker-extract
View File

@ -44,6 +44,7 @@ profile tracker-extract @{exec_path} {
owner @{run}/user/@{uid}/dconf/ rw,
owner @{run}/user/@{uid}/dconf/user rw,
@{run}/blkid/blkid.tab r,
@{run}/udev/data/c235:* r,
@{run}/udev/data/c236:* r,

3
apparmor.d/groups/gnome/tracker-miner
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}lib/tracker-miner-fs-{,control-}3
profile tracker-miner @{exec_path} {
include <abstractions/base>
include <abstractions/dconf>
include <abstractions/disks-read>
include <abstractions/private-files-strict>
include <abstractions/private-files>
@ -38,9 +39,9 @@ profile tracker-miner @{exec_path} {
owner @{PROC}/@{pid}/mounts r,
@{PROC}/sys/fs/inotify/max_user_watches r,
include <abstractions/dconf>
owner @{run}/user/@{uid}/dconf/ rw,
owner @{run}/user/@{uid}/dconf/user rw,
@{run}/blkid/blkid.tab r,
@{run}/mount/utab r,

2
apparmor.d/groups/systemd/systemd-logind
View File

@ -46,12 +46,14 @@ profile systemd-logind @{exec_path} flags=(complain) {
@{run}/udev/data/c116:[0-9]* r, # for ALSA
@{run}/udev/data/c226:[0-9]* r, # for /dev/dri/card*
@{run}/udev/data/c23[0-9]:[0-9]* r,
@{run}/udev/data/c29:[0-9]* r,
@{run}/udev/data/c50[0-9]:[0-9]* r,
@{run}/udev/data/c51[0-9]:[0-9]* r,
@{run}/udev/data/+input* r, # for mouse, keyboard, touchpad
@{run}/udev/data/+drm:card[0-9]-* r, # for screen outputs
@{run}/udev/data/+backlight:intel_backlight r,
@{run}/udev/data/+pci* r,
@{run}/systemd/seats/ rw,
@{run}/systemd/seats/.#seat* rw,

1
apparmor.d/groups/systemd/systemd-tty-ask-password-agent
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/systemd-tty-ask-password-agent
profile systemd-tty-ask-password-agent @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
@{exec_path} mr,

5
apparmor.d/groups/systemd/zram-generator
View File

@ -13,8 +13,9 @@ profile zram-generator @{exec_path} {
@{exec_path} mr,
/{usr/,}lib/systemd/systemd-makefs rPx,
/{usr/,}bin/systemd-detect-virt rPx,
/{usr/,}bin/kmod rix,
/{usr/,}bin/systemd-detect-virt rPx,
/{usr/,}lib/systemd/systemd-makefs rPx,
/etc/systemd/zram-generator.conf r,

1
apparmor.d/profiles-a-f/aa-status
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}{s,}bin/aa-status
profile aa-status @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
capability dac_read_search,
capability sys_ptrace,

9
apparmor.d/profiles-a-f/borg
View File

@ -1,6 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2020-2021 Mikhail Morfikov
# 2021 Alexandre Pujol <alexandre@pujol.io>
# Copyright (C) 2020-2022 Mikhail Morfikov
# Copyright (C) 2021-2022 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -43,6 +43,7 @@ profile borg @{exec_path} {
@{PROC}/sys/kernel/random/boot_id r,
@{run}/systemd/userdb/ r,
@{run}/resolvconf/resolv.conf r,
owner @{user_cache_dirs}/ rw,
owner @{user_cache_dirs}/borg/ rw,
@ -80,6 +81,10 @@ profile borg @{exec_path} {
owner @{MOUNTS}/ r,
owner @{MOUNTS}/** rwkl -> @{MOUNTS}/**,
# borg serve on server's side
owner /home/borg/*/ rw,
owner /home/borg/*/{,**} rw,
# For exporting the key
owner /**/key w,

1
apparmor.d/profiles-a-f/dmidecode
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}{s,}bin/dmidecode
profile dmidecode @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
@{exec_path} mr,

2
apparmor.d/profiles-g-l/hostname
View File

@ -18,5 +18,7 @@ profile hostname @{exec_path} {
@{exec_path} mr,
@{run}/resolvconf/resolv.conf r,
include if exists <local/hostname>
}

5
apparmor.d/profiles-g-l/ifup
View File

@ -52,7 +52,10 @@ profile ifup @{exec_path} {
/{usr/,}bin/run-parts mr,
/{usr/,}lib/bridge-utils/ifupdown.sh rPUx,
/etc/network/if-down.d/ r,
/etc/network/if-down.d/resolvconf rPUx,
/etc/network/if-down.d/openvpn rPUx,
/etc/network/if-down.d/wpasupplicant rPUx,
/etc/wpa_supplicant/ifupdown.sh rPUx,
@ -70,7 +73,6 @@ profile ifup @{exec_path} {
/etc/network/if-pre-up.d/ r,
/etc/network/if-pre-up.d/bridge rPUx,
/{usr/,}lib/bridge-utils/ifupdown.sh rPUx,
/etc/network/if-pre-up.d/ethtool rPUx,
/etc/network/if-pre-up.d/hostapd rPUx,
/etc/network/if-pre-up.d/ifenslave rPUx,
@ -109,6 +111,7 @@ profile ifup @{exec_path} {
include <abstractions/base>
# capability mac_admin,
capability net_admin,
capability sys_admin,
# capability sys_resource,

1
apparmor.d/profiles-g-l/ip
View File

@ -10,6 +10,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/ip
profile ip @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/consoles>
capability net_admin,
capability sys_module,

1
apparmor.d/profiles-g-l/lsblk
View File

@ -9,6 +9,7 @@ include <tunables/global>
@{exec_path} = /{usr/,}bin/lsblk
profile lsblk @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/disks-read>
include <abstractions/nameservice-strict>

2
apparmor.d/profiles-m-r/on-ac-power
View File

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}{s,}bin/on_ac_power /{usr/,}bin/on_ac_power
@{exec_path} = /{usr/,}{s,}bin/on_ac_power
profile on-ac-power @{exec_path} {
include <abstractions/base>

19
apparmor.d/profiles-s-z/sensors
View File

@ -1,6 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2015-2020 Mikhail Morfikov
# 2021 Alexandre Pujol <alexandre@pujol.io>
# Copyright (C) 2015-2022 Mikhail Morfikov
# Copyright (C) 2021-2022 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -18,18 +18,19 @@ profile sensors @{exec_path} {
/etc/sensors.d/{,*} r,
/etc/sensors3.conf r,
@{sys}/devices/pci[0-9]*/**/name r,
@{sys}/class/i2c-adapter/ r,
@{sys}/class/hwmon/ r,
@{sys}/class/i2c-adapter/ r,
@{sys}/devices/**/hwmon*/{,**/} r,
@{sys}/devices/**/hwmon*/{in[0-9]_label,in[0-9]_min,in[0-9]_max} r,
@{sys}/devices/**/hwmon*/{name,temp*,*_input} r,
@{sys}/devices/**/hwmon*/**/{name,temp*,*_input} r,
@{sys}/devices/**/hwmon/hwmon[0-9]*/power[0-9]*_crit r,
@{sys}/devices/i2c-[0-9]*/name r,
@{sys}/devices/pci[0-9]*/**/name r,
@{sys}/devices/virtual/hwmon/hwmon[0-9]* r,
@{sys}/devices/virtual/hwmon/hwmon[0-9]*/ r,
@{sys}/devices/virtual/hwmon/hwmon[0-9]*/{name,temp*} r,
@{sys}/devices/virtual/hwmon/hwmon[0-9]*/fan[0-9]_label r,
@{sys}/devices/**/hwmon*/{,**/} r,
@{sys}/devices/**/hwmon*/{name,temp*,*_input} r,
@{sys}/devices/**/hwmon*/{in[0-9]_label,in[0-9]_min,in[0-9]_max} r,
@{sys}/devices/**/hwmon*/**/{name,temp*,*_input} r,
# file_inherit
deny @{PROC}/@{pid}/net/dev r,

5
apparmor.d/profiles-s-z/sensors-detect
View File

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2020-2021 Mikhail Morfikov
# Copyright (C) 2020-2022 Mikhail Morfikov
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -37,7 +38,7 @@ profile sensors-detect @{exec_path} {
/dev/i2c-[0-9]* r,
owner @{PROC}/@{pid}/mounts r,
/proc/modules r,
@{PROC}/modules r,
profile udevadm {

1
apparmor.d/profiles-s-z/sudo
View File

@ -78,6 +78,7 @@ profile sudo @{exec_path} {
@{run}/systemd/userdb/ r,
@{run}/systemd/userdb/io.systemd.DynamicUser rw,
@{run}/resolvconf/resolv.conf r,
/dev/ r, # interactive login
/dev/ptmx rw,