mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-11-14 23:43:56 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

systemd: better profilling and rename journalctl.

Browse Source
This commit is contained in:
Alexandre Pujol 2021-04-21 21:55:50 +01:00
parent 1c9df4b3b9
commit 7029d40c5e
No known key found for this signature in database
GPG Key ID: C5469996F0DF68EC
3 changed files with 14 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
apparmor.d/groups/systemd/journalctl
View File

@ -8,9 +8,10 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/journalctl
profile systemd-journalctl @{exec_path} {
profile journalctl @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/nameservice-strict>
include <abstractions/systemd-common>
capability sys_resource,

1
apparmor.d/groups/systemd/systemd-logind
View File

@ -82,6 +82,7 @@ profile systemd-logind @{exec_path} flags=(complain) {
@{sys}/firmware/efi/efivars/LoaderFeatures-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* r,
@{PROC}/@{pid}/cgroup r,
@{PROC}/@{pid}/comm r,
@{PROC}/@{pid}/fd/ r,
@{PROC}/@{pid}/sessionid r,
@{PROC}/@{pid}/stat r,

12
apparmor.d/groups/systemd/systemd-machined
View File

@ -11,14 +11,24 @@ profile systemd-machined @{exec_path} flags=(complain) {
include <abstractions/base>
include <abstractions/systemd-common>
capability chown,
capability dac_override,
capability dac_read_search,
capability fowner,
capability fsetid,
capability kill,
capability mknod,
capability setgid,
capability sys_admin,
capability sys_chroot,
capability sys_ptrace,
@{exec_path} mr,
/etc/machine-id r,
@{run}/systemd/machines/{,**} r,
@{run}/systemd/userdb/io.systemd.Machine rw,
@{run}/systemd/machines/ r,
include if exists <local/systemd-machined>
}