mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2024-12-24 14:06:47 +01:00
update apparmor profiles
This commit is contained in:
Mikhail Morfikov
parent
156f5d4e3b
commit
756e2071e1
55 changed files with 398 additions and 75 deletions
|
|
@ -39,5 +39,8 @@
|
|||
# python build configuration and headers
|
||||
/usr/include/python{2.[4-7],3.[0-9]}*/pyconfig.h r,
|
||||
|
||||
# Silencer
|
||||
/{usr/,}lib/python3/** w,
|
||||
|
||||
# Include additions to the abstraction
|
||||
include if exists <abstractions/python.d>
|
||||
|
|
|
|||
|
|
@ -67,7 +67,7 @@ profile apt @{exec_path} flags=(complain) {
|
|||
# Needed? (##FIXME##)
|
||||
capability kill,
|
||||
capability fsetid,
|
||||
capability net_admin,
|
||||
audit deny capability net_admin,
|
||||
|
||||
signal (send) peer=apt-methods-*,
|
||||
|
||||
|
|
|
|||
|
|
@ -66,7 +66,7 @@ profile apt-get @{exec_path} flags=(complain) {
|
|||
# Needed? (##FIXME##)
|
||||
capability kill,
|
||||
capability fsetid,
|
||||
capability net_admin,
|
||||
audit deny capability net_admin,
|
||||
|
||||
signal (send) peer=apt-methods-*,
|
||||
|
||||
|
|
|
|||
|
|
@ -17,6 +17,10 @@ include <tunables/global>
|
|||
profile apt-systemd-daily @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
# Needed to remove the following error:
|
||||
# apt.systemd.daily[]: find: ‘/var/cache/apt/archives/partial’: Permission denied
|
||||
capability dac_read_search,
|
||||
|
||||
@{exec_path} mrix,
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
||||
|
|
@ -29,6 +33,7 @@ profile apt-systemd-daily @{exec_path} {
|
|||
/{usr/,}bin/which rix,
|
||||
/{usr/,}bin/touch rix,
|
||||
/{usr/,}bin/basename rix,
|
||||
/{usr/,}bin/dirname rix,
|
||||
/{usr/,}bin/date rix,
|
||||
/{usr/,}bin/find rix,
|
||||
/{usr/,}bin/du rix,
|
||||
|
|
@ -37,6 +42,8 @@ profile apt-systemd-daily @{exec_path} {
|
|||
/{usr/,}bin/uniq rix,
|
||||
/{usr/,}bin/wc rix,
|
||||
/{usr/,}bin/seq rix,
|
||||
/{usr/,}bin/xargs rix,
|
||||
/{usr/,}bin/gzip rix,
|
||||
|
||||
/{usr/,}bin/apt-config rPx,
|
||||
/{usr/,}bin/apt-get rPx,
|
||||
|
|
@ -49,11 +56,18 @@ profile apt-systemd-daily @{exec_path} {
|
|||
|
||||
/var/lib/apt/extended_states r,
|
||||
|
||||
/var/backups/apt.extended_states.[0-9]* r,
|
||||
/var/backups/ r,
|
||||
/var/backups/apt.extended_states rw,
|
||||
/var/backups/apt.extended_states.[0-9]* rw,
|
||||
/var/backups/apt.extended_states.[0-9]*.gz w,
|
||||
|
||||
/var/cache/apt/ r,
|
||||
/var/cache/apt/archives/ r,
|
||||
/var/cache/apt/archives/partial/ r,
|
||||
/var/cache/apt/archives/*.deb rw,
|
||||
/var/cache/apt/backup/ r,
|
||||
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
|
||||
include if exists <local/apt-systemd-daily>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -67,7 +67,7 @@ profile aptitude @{exec_path} flags=(complain) {
|
|||
capability kill,
|
||||
capability fsetid,
|
||||
capability sys_chroot,
|
||||
capability net_admin,
|
||||
audit deny capability net_admin,
|
||||
#capability sys_tty_config,
|
||||
|
||||
signal (send) peer=apt-methods-*,
|
||||
|
|
|
|||
|
|
@ -29,7 +29,9 @@ profile birdtray @{exec_path} {
|
|||
include <abstractions/ssl_certs>
|
||||
include <abstractions/deny-root-dir-access>
|
||||
|
||||
deny network netlink dgram,
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
network netlink dgram,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
|
|||
|
|
@ -22,7 +22,8 @@ profile bluetoothd @{exec_path} {
|
|||
capability net_admin,
|
||||
capability net_bind_service,
|
||||
|
||||
network bluetooth,
|
||||
network bluetooth raw,
|
||||
network bluetooth seqpacket,
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
|
|
|||
|
|
@ -174,9 +174,6 @@ profile calibre @{exec_path} {
|
|||
/etc/inputrc r,
|
||||
/etc/magic r,
|
||||
|
||||
# Silencer
|
||||
deny /usr/lib/python3/dist-packages/**.pyc.[0-9]* w,
|
||||
|
||||
# file_inherit
|
||||
owner /dev/tty[0-9]* rw,
|
||||
owner @{HOME}/.xsession-errors w,
|
||||
|
|
|
|||
|
|
@ -43,9 +43,9 @@ profile check-bios-nx @{exec_path} {
|
|||
|
||||
/etc/modprobe.d/ r,
|
||||
/etc/modprobe.d/*.conf r,
|
||||
/usr/lib/modprobe.d/ r,
|
||||
/usr/lib/modprobe.d/*.conf r,
|
||||
/usr/lib/modules/*/modules.* r,
|
||||
/{usr/,}lib/modprobe.d/ r,
|
||||
/{usr/,}lib/modprobe.d/*.conf r,
|
||||
/{usr/,}lib/modules/*/modules.* r,
|
||||
|
||||
@{PROC}/cmdline r,
|
||||
|
||||
|
|
|
|||
|
|
@ -14,15 +14,13 @@ abi <abi/3.0>,
|
|||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/check-support-status
|
||||
profile check-support-status @{exec_path} flags=(complain) {
|
||||
profile check-support-status @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
|
||||
@{exec_path} rix,
|
||||
/{usr/,}bin/{,ba,da}sh rix,
|
||||
|
||||
/etc/debian_version r,
|
||||
|
||||
/{usr/,}bin/ r,
|
||||
/{usr/,}bin/gettext.sh r,
|
||||
/{usr/,}bin/cat rix,
|
||||
|
|
@ -53,7 +51,12 @@ profile check-support-status @{exec_path} flags=(complain) {
|
|||
|
||||
/{usr/,}bin/debconf-escape rCx -> debconf-escape,
|
||||
|
||||
/etc/debian_version r,
|
||||
|
||||
# For shell pwd
|
||||
/ r,
|
||||
owner @{HOME}/ r,
|
||||
|
||||
/tmp/ r,
|
||||
owner /tmp/debian-security-support.*/{,**} rw,
|
||||
/tmp/debian-security-support.postinst.*/output w,
|
||||
|
|
@ -66,7 +69,7 @@ profile check-support-status @{exec_path} flags=(complain) {
|
|||
/usr/share/debian-security-support/* r,
|
||||
|
||||
|
||||
profile debconf-escape flags=(complain) {
|
||||
profile debconf-escape {
|
||||
include <abstractions/base>
|
||||
include <abstractions/perl>
|
||||
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@ abi <abi/3.0>,
|
|||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /usr/share/debian-security-support/check-support-status.hook
|
||||
profile check-support-status-hook @{exec_path} flags=(complain) {
|
||||
profile check-support-status-hook @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
|
@ -53,7 +53,7 @@ profile check-support-status-hook @{exec_path} flags=(complain) {
|
|||
/var/lib/debian-security-support/ r,
|
||||
|
||||
|
||||
profile debconf-escape flags=(complain) {
|
||||
profile debconf-escape {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/perl>
|
||||
|
|
@ -66,7 +66,7 @@ profile check-support-status-hook @{exec_path} flags=(complain) {
|
|||
|
||||
}
|
||||
|
||||
profile frontend flags=(complain) {
|
||||
profile frontend {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/perl>
|
||||
|
|
@ -98,7 +98,7 @@ profile check-support-status-hook @{exec_path} flags=(complain) {
|
|||
|
||||
}
|
||||
|
||||
profile runuser flags=(complain) {
|
||||
profile runuser {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
|
|
|||
|
|
@ -28,7 +28,7 @@ profile dhclient @{exec_path} {
|
|||
capability net_bind_service,
|
||||
|
||||
# Needed?
|
||||
#capability net_admin,
|
||||
audit deny capability net_admin,
|
||||
audit deny capability sys_module,
|
||||
|
||||
network inet dgram,
|
||||
|
|
|
|||
|
|
@ -58,7 +58,7 @@ profile dkms @{exec_path} {
|
|||
capability setuid,
|
||||
capability setgid,
|
||||
/proc/sys/kernel/osrelease r,
|
||||
/usr/lib/linux-kbuild-*/tools/objtool/objtool rix,
|
||||
/{usr/,}lib/linux-kbuild-*/tools/objtool/objtool rix,
|
||||
|
||||
/ r,
|
||||
/{usr/,}lib/modules/*/updates/ rw,
|
||||
|
|
|
|||
|
|
@ -65,14 +65,19 @@ profile engrampa @{exec_path} {
|
|||
owner @{HOME}/.cache/ rw,
|
||||
owner @{HOME}/.cache/.fr-*/{,**} rw,
|
||||
|
||||
owner @{HOME}/.config/ r,
|
||||
owner @{HOME}/.config/mimeapps.list{,.*} rw,
|
||||
|
||||
owner @{HOME}/.local/share/ r,
|
||||
|
||||
/usr/share/engrampa/{,**} r,
|
||||
|
||||
/usr/share/**.desktop r,
|
||||
/usr/share/**/icons/**.png r,
|
||||
|
||||
/usr/share/glib-2.0/schemas/gschemas.compiled r,
|
||||
|
||||
owner @{PROC}/@{pid}/cgroup r,
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
@{PROC}/@{pid}/mountinfo r,
|
||||
@{PROC}/@{pid}/mounts r,
|
||||
|
|
|
|||
|
|
@ -19,27 +19,48 @@ profile exim4 @{exec_path} {
|
|||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
network inet,
|
||||
network inet6,
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mrix,
|
||||
|
||||
# To bind to port 25/tcp
|
||||
capability net_bind_service,
|
||||
|
||||
# To remove the following error:
|
||||
# exim4[]: exim: setgroups() failed: Operation not permitted
|
||||
capability setgid,
|
||||
|
||||
# To remove the following error:
|
||||
# exim4[]: unable to set gid=110 or uid=105 (euid=0): calling tls_validate_require_cipher
|
||||
capability setuid,
|
||||
|
||||
# To remove the following error:
|
||||
# exim4[]: Cannot open main log file "/var/log/exim4/mainlog": Permission denied: euid=0 egid=110
|
||||
capability dac_read_search,
|
||||
capability dac_override,
|
||||
capability setgid,
|
||||
capability setuid,
|
||||
|
||||
# To remove the following error:
|
||||
# exim.c:774: chown(/var/spool/exim4//msglog//1kqH5Z-000RUf-UR, 105:110) failed (Operation not
|
||||
# permitted). Please contact the authors and refer to https://bugs.exim.org/show_bug.cgi?id=2391
|
||||
capability chown,
|
||||
|
||||
# To remove the following error:
|
||||
# Couldn't chmod message log /var/spool/exim4//msglog//1kqH6c-000S7r-Ni: Operation not permitted
|
||||
capability fowner,
|
||||
capability net_bind_service,
|
||||
# Sendmail
|
||||
capability net_admin,
|
||||
|
||||
# Needed?
|
||||
audit deny capability net_admin,
|
||||
|
||||
/var/lib/exim4/config.autogenerated{,.tmp} r,
|
||||
|
||||
/etc/email-addresses r,
|
||||
/etc/aliases r,
|
||||
|
||||
deny /var/log/exim4/ w,
|
||||
/var/log/exim4/mainlog w,
|
||||
/var/log/exim4/paniclog w,
|
||||
|
||||
|
|
|
|||
|
|
@ -35,7 +35,7 @@ profile gajim @{exec_path} {
|
|||
network inet6 dgram,
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
deny network netlink raw,
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} r,
|
||||
|
||||
|
|
|
|||
26
apparmor.d/gsimplecal
Normal file
26
apparmor.d/gsimplecal
Normal file
|
|
@ -0,0 +1,26 @@
|
|||
# vim:syntax=apparmor
|
||||
# ------------------------------------------------------------------
|
||||
#
|
||||
# Copyright (C) 2020 Mikhail Morfikov
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of version 2 of the GNU General Public
|
||||
# License published by the Free Software Foundation.
|
||||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/gsimplecal
|
||||
profile gsimplecal @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/gtk>
|
||||
include <abstractions/fonts>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
include if exists <local/gsimplecal>
|
||||
}
|
||||
|
|
@ -123,7 +123,6 @@ profile hardinfo @{exec_path} {
|
|||
|
||||
# Silencer
|
||||
deny /usr/share/gdb/python/** w,
|
||||
deny /usr/lib/python3/** w,
|
||||
|
||||
# file_inherit
|
||||
owner /dev/tty[0-9]* rw,
|
||||
|
|
|
|||
|
|
@ -30,7 +30,7 @@ profile htop @{exec_path} {
|
|||
capability sys_ptrace,
|
||||
|
||||
# Needed?
|
||||
capability net_admin,
|
||||
audit deny capability net_admin,
|
||||
|
||||
signal (send),
|
||||
ptrace (read),
|
||||
|
|
|
|||
|
|
@ -19,7 +19,8 @@ profile iotop @{exec_path} {
|
|||
include <abstractions/python>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability net_admin,
|
||||
# Needed?
|
||||
audit deny capability net_admin,
|
||||
|
||||
# To set processes' priorities
|
||||
capability sys_nice,
|
||||
|
|
|
|||
|
|
@ -22,9 +22,8 @@ profile ip @{exec_path} flags=(attach_disconnected) {
|
|||
# To be able to manage network interfaces.
|
||||
capability net_admin,
|
||||
|
||||
#capability sys_admin,
|
||||
|
||||
# Needed?
|
||||
#capability sys_admin,
|
||||
audit deny capability sys_module,
|
||||
|
||||
network netlink raw,
|
||||
|
|
|
|||
|
|
@ -43,8 +43,8 @@ profile kvm-ok @{exec_path} {
|
|||
|
||||
/etc/modprobe.d/ r,
|
||||
/etc/modprobe.d/*.conf r,
|
||||
/usr/lib/modprobe.d/ r,
|
||||
/usr/lib/modprobe.d/*.conf r,
|
||||
/{usr/,}lib/modprobe.d/ r,
|
||||
/{usr/,}lib/modprobe.d/*.conf r,
|
||||
|
||||
@{PROC}/cmdline r,
|
||||
|
||||
|
|
|
|||
|
|
@ -27,7 +27,9 @@ profile logrotate @{exec_path} flags=(attach_disconnected, complain) {
|
|||
capability setuid,
|
||||
capability fsetid,
|
||||
capability fowner,
|
||||
capability net_admin,
|
||||
|
||||
# Needed?
|
||||
audit deny capability net_admin,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
|
|||
|
|
@ -17,6 +17,8 @@ include <tunables/global>
|
|||
profile macchanger @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
# To be able to set the MAC address:
|
||||
# [ERROR] Could not change MAC: interface up or insufficient permissions: Operation not permitted
|
||||
capability net_admin,
|
||||
|
||||
network inet dgram,
|
||||
|
|
|
|||
|
|
@ -36,8 +36,8 @@ profile minitube @{exec_path} {
|
|||
network inet6 dgram,
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
deny network netlink dgram,
|
||||
deny network netlink raw,
|
||||
network netlink dgram,
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
|
|||
|
|
@ -68,8 +68,5 @@ profile mpsyt @{exec_path} {
|
|||
owner /tmp/mpsyt-input* rw,
|
||||
owner /tmp/mpsyt-mpv*.sock rw,
|
||||
|
||||
# Silencer
|
||||
/usr/lib/python3/** w,
|
||||
|
||||
include if exists <local/mpsyt>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -18,6 +18,7 @@ profile nft @{exec_path} {
|
|||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
# To be able to run the nft command.
|
||||
capability net_admin,
|
||||
|
||||
network netlink raw,
|
||||
|
|
|
|||
|
|
@ -38,6 +38,7 @@ profile openbox @{exec_path} {
|
|||
/etc/xdg/openbox/* r,
|
||||
|
||||
owner @{HOME}/ r,
|
||||
owner @{HOME}/.config/openbox/ r,
|
||||
owner @{HOME}/.config/openbox/* r,
|
||||
|
||||
owner @{HOME}/.config/obmenu-generator/icons/[0-9a-f]*.png r,
|
||||
|
|
|
|||
|
|
@ -29,7 +29,11 @@ profile openvpn @{exec_path} {
|
|||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/openssl>
|
||||
|
||||
# Needed to remove the following errors:
|
||||
# ERROR: Cannot ioctl TUNSETIFF tun: Operation not permitted (errno=1)
|
||||
# Exiting due to fatal error
|
||||
capability net_admin,
|
||||
|
||||
# These are needed when user/group are set in a OpenVPN config file
|
||||
capability setuid,
|
||||
capability setgid,
|
||||
|
|
@ -75,6 +79,7 @@ profile openvpn @{exec_path} {
|
|||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
# To be able to manage firewall rules.
|
||||
capability net_admin,
|
||||
|
||||
/etc/openvpn/update-resolv-conf.sh r,
|
||||
|
|
@ -95,6 +100,7 @@ profile openvpn @{exec_path} {
|
|||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
# To be able to manage firewall rules.
|
||||
capability net_admin,
|
||||
|
||||
network netlink raw,
|
||||
|
|
|
|||
46
apparmor.d/picom
Normal file
46
apparmor.d/picom
Normal file
|
|
@ -0,0 +1,46 @@
|
|||
# vim:syntax=apparmor
|
||||
# ------------------------------------------------------------------
|
||||
#
|
||||
# Copyright (C) 2020 Mikhail Morfikov
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of version 2 of the GNU General Public
|
||||
# License published by the Free Software Foundation.
|
||||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/picom{,-trans}
|
||||
profile picom @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/dri-common>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/mesa-cache-write>
|
||||
include <abstractions/deny-root-dir-access>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/{usr/,}bin/sed rix,
|
||||
/{usr/,}bin/xargs rix,
|
||||
/{usr/,}bin/{,e}grep rix,
|
||||
/{usr/,}bin/echo rix,
|
||||
|
||||
# For migrating from compton.
|
||||
owner @{HOME}/.config/compton.conf r,
|
||||
|
||||
owner @{HOME}/.config/picom.conf r,
|
||||
|
||||
owner @{HOME}/.Xauthority r,
|
||||
|
||||
@{sys}/devices/pci[0-9]*/**/{uevent,vendor,device,subsystem_vendor,subsystem_device} r,
|
||||
|
||||
owner @{PROC}/@{pid}/fd/ r,
|
||||
|
||||
# file_inherit
|
||||
owner /dev/tty[0-9]* rw,
|
||||
|
||||
include if exists <local/picom>
|
||||
}
|
||||
|
|
@ -22,8 +22,8 @@ profile polkitd @{exec_path} {
|
|||
capability setuid,
|
||||
capability setgid,
|
||||
|
||||
# What's this for?
|
||||
capability net_admin,
|
||||
# Needed?
|
||||
audit deny capability net_admin,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
|
|||
|
|
@ -40,7 +40,7 @@ profile psi-plus @{exec_path} {
|
|||
network inet6 dgram,
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
deny network netlink dgram,
|
||||
network netlink dgram,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
|
|||
|
|
@ -41,8 +41,8 @@ profile qbittorrent @{exec_path} {
|
|||
network inet6 dgram,
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
deny network netlink dgram,
|
||||
deny network netlink raw,
|
||||
network netlink dgram,
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
|
|||
|
|
@ -27,8 +27,8 @@ profile qbittorrent-nox @{exec_path} {
|
|||
network inet6 dgram,
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
deny network netlink dgram,
|
||||
deny network netlink raw,
|
||||
network netlink dgram,
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
|
|||
|
|
@ -68,8 +68,8 @@ profile qnapi @{exec_path} {
|
|||
network inet6 dgram,
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
deny network netlink raw,
|
||||
deny network netlink dgram,
|
||||
network netlink raw,
|
||||
network netlink dgram,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
|
|||
|
|
@ -96,9 +96,6 @@ profile reportbug @{exec_path} {
|
|||
# Allowed apps to open
|
||||
/{usr/,}lib/firefox/firefox rPUx,
|
||||
|
||||
# Silencer
|
||||
/usr/lib/python3/** w,
|
||||
|
||||
|
||||
profile run-parts {
|
||||
include <abstractions/base>
|
||||
|
|
|
|||
|
|
@ -23,17 +23,19 @@ profile rsyslogd @{exec_path} {
|
|||
include <abstractions/base>
|
||||
include <abstractions/nameservice>
|
||||
|
||||
# Needed to remove the following error:
|
||||
# rsyslogd[]: imklog: cannot open kernel log (/proc/kmsg): Operation not permitted.
|
||||
capability syslog,
|
||||
|
||||
# for remote logs
|
||||
# For remote logs
|
||||
capability net_admin,
|
||||
|
||||
# Needed?
|
||||
deny capability sys_nice,
|
||||
|
||||
# for creating new log files and changing their owner/group
|
||||
capability chown,
|
||||
|
||||
# Needed?
|
||||
deny capability sys_nice,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/{usr/,}lib/@{multiarch}/rsyslog/*.so mr,
|
||||
|
|
|
|||
|
|
@ -25,7 +25,8 @@ profile smartd @{exec_path} {
|
|||
# Device: /dev/disk/by-id/ata-*, not available
|
||||
capability sys_rawio,
|
||||
|
||||
capability net_admin,
|
||||
# Needed?
|
||||
deny capability net_admin,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
|
|||
|
|
@ -33,8 +33,8 @@ profile smtube @{exec_path} {
|
|||
network inet6 dgram,
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
deny network netlink dgram,
|
||||
deny network netlink raw,
|
||||
network netlink dgram,
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
|
|||
|
|
@ -57,6 +57,9 @@ profile spacefm @{exec_path} {
|
|||
@{sys}/devices/system/node/ r,
|
||||
@{sys}/devices/system/node/node[0-9]*/meminfo r,
|
||||
|
||||
@{sys}/fs/cgroup/**/cpu.cfs_quota_us r,
|
||||
@{sys}/fs/cgroup/**/cpu.cfs_period_us r,
|
||||
|
||||
# To read/write files in the system. The read permission is granted for all files, the write
|
||||
# permission only for the owner. Also, dirs like /dev/, /efi/, /proc/, /sys/ are not included in
|
||||
# the list.
|
||||
|
|
|
|||
|
|
@ -40,8 +40,8 @@ profile strawberry @{exec_path} {
|
|||
network inet6 dgram,
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
deny network netlink dgram,
|
||||
deny network netlink raw,
|
||||
network netlink dgram,
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
|
|||
|
|
@ -38,6 +38,12 @@ profile sudo @{exec_path} {
|
|||
# Needed? (#FIXME#)
|
||||
capability sys_resource,
|
||||
|
||||
# To remove the following error:
|
||||
# sudo: PAM account management error: Permission denied
|
||||
# sudo: unable to open audit system: Permission denied
|
||||
# sudo: a password is required
|
||||
network netlink raw,
|
||||
|
||||
signal,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
|
|
|||
29
apparmor.d/systemd-ac-power
Normal file
29
apparmor.d/systemd-ac-power
Normal file
|
|
@ -0,0 +1,29 @@
|
|||
# vim:syntax=apparmor
|
||||
# ------------------------------------------------------------------
|
||||
#
|
||||
# Copyright (C) 2018-2020 Mikhail Morfikov
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of version 2 of the GNU General Public
|
||||
# License published by the Free Software Foundation.
|
||||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}lib/systemd/systemd-ac-power
|
||||
profile systemd-ac-power @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
owner @{PROC}/@{pid}/stat r,
|
||||
|
||||
@{sys}/class/power_supply/ r,
|
||||
|
||||
@{sys}/devices/**/power_supply/{AC,BAT[0-9]*}/ r,
|
||||
@{sys}/devices/**/power_supply/{AC,BAT[0-9]*}/{type,online} r,
|
||||
|
||||
}
|
||||
49
apparmor.d/systemd-backlight
Normal file
49
apparmor.d/systemd-backlight
Normal file
|
|
@ -0,0 +1,49 @@
|
|||
# vim:syntax=apparmor
|
||||
# ------------------------------------------------------------------
|
||||
#
|
||||
# Copyright (C) 2018-2020 Mikhail Morfikov
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of version 2 of the GNU General Public
|
||||
# License published by the Free Software Foundation.
|
||||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}lib/systemd/systemd-backlight
|
||||
profile systemd-backlight @{exec_path} flags=(complain) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
|
||||
# Needed?
|
||||
deny capability net_admin,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{sys}/bus/ r,
|
||||
@{sys}/class/ r,
|
||||
@{sys}/class/backlight/ r,
|
||||
|
||||
@{sys}/devices/pci[0-9]*/**/class r,
|
||||
@{sys}/devices/pci[0-9]*/**/backlight/**/brightness rw,
|
||||
@{sys}/devices/pci[0-9]*/**/backlight/**/{max_brightness,actual_brightness} r,
|
||||
@{sys}/devices/pci[0-9]*/**/backlight/**/{uevent,type} r,
|
||||
@{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/**/brightness rw,
|
||||
@{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/**/{max_brightness,actual_brightness} r,
|
||||
@{sys}/devices/pci[0-9]*/**/drm/card[0-9]*/**/{uevent,type} r,
|
||||
|
||||
@{sys}/devices/platform/**/leds/*backlight*/uevent r,
|
||||
@{sys}/devices/platform/**/leds/*backlight*/max_brightness r,
|
||||
@{sys}/devices/platform/**/leds/*backlight*/brightness rw,
|
||||
|
||||
|
||||
@{run}/udev/data/+backlight:* r,
|
||||
@{run}/udev/data/+leds:*backlight* r,
|
||||
|
||||
/var/lib/systemd/backlight/*backlight* rw,
|
||||
|
||||
}
|
||||
|
||||
29
apparmor.d/systemd-detect-virt
Normal file
29
apparmor.d/systemd-detect-virt
Normal file
|
|
@ -0,0 +1,29 @@
|
|||
# vim:syntax=apparmor
|
||||
# ------------------------------------------------------------------
|
||||
#
|
||||
# Copyright (C) 2020 Mikhail Morfikov
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of version 2 of the GNU General Public
|
||||
# License published by the Free Software Foundation.
|
||||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}bin/systemd-detect-virt
|
||||
profile systemd-detect-virt @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{sys}/devices/virtual/dmi/id/product_name r,
|
||||
@{sys}/devices/virtual/dmi/id/sys_vendor r,
|
||||
@{sys}/devices/virtual/dmi/id/board_vendor r,
|
||||
@{sys}/devices/virtual/dmi/id/bios_vendor r,
|
||||
|
||||
include if exists <local/systemd-detect-virt>
|
||||
}
|
||||
|
|
@ -14,15 +14,17 @@ abi <abi/3.0>,
|
|||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}lib/systemd/systemd-fsck
|
||||
profile systemd-fsck @{exec_path} flags=(complain) {
|
||||
profile systemd-fsck @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/disks-read>
|
||||
include <abstractions/systemd-common>
|
||||
|
||||
capability net_admin,
|
||||
capability sys_resource,
|
||||
|
||||
# Needed?
|
||||
deny capability net_admin,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/{usr/,}sbin/fsck rPx,
|
||||
|
|
|
|||
|
|
@ -14,14 +14,16 @@ abi <abi/3.0>,
|
|||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}lib/systemd/systemd-fsckd
|
||||
profile systemd-fsckd @{exec_path} flags=(complain) {
|
||||
profile systemd-fsckd @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/systemd-common>
|
||||
|
||||
capability net_admin,
|
||||
capability sys_tty_config,
|
||||
|
||||
# Needed?
|
||||
deny capability net_admin,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
owner @{run}/systemd/fsck.progress w,
|
||||
|
|
|
|||
35
apparmor.d/systemd-hostnamed
Normal file
35
apparmor.d/systemd-hostnamed
Normal file
|
|
@ -0,0 +1,35 @@
|
|||
# vim:syntax=apparmor
|
||||
# ------------------------------------------------------------------
|
||||
#
|
||||
# Copyright (C) 2018-2020 Mikhail Morfikov
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of version 2 of the GNU General Public
|
||||
# License published by the Free Software Foundation.
|
||||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}lib/systemd/systemd-hostnamed
|
||||
profile systemd-hostnamed @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
|
||||
# To set a hostname
|
||||
capability sys_admin,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
@{sys}/devices/virtual/dmi/id/product_name r,
|
||||
@{sys}/devices/virtual/dmi/id/sys_vendor r,
|
||||
@{sys}/devices/virtual/dmi/id/board_vendor r,
|
||||
@{sys}/devices/virtual/dmi/id/bios_vendor r,
|
||||
@{sys}/devices/virtual/dmi/id/chassis_type r,
|
||||
|
||||
/etc/hostname rw,
|
||||
/etc/.#hostname* rw,
|
||||
|
||||
}
|
||||
34
apparmor.d/systemd-localed
Normal file
34
apparmor.d/systemd-localed
Normal file
|
|
@ -0,0 +1,34 @@
|
|||
# vim:syntax=apparmor
|
||||
# ------------------------------------------------------------------
|
||||
#
|
||||
# Copyright (C) 2018-2020 Mikhail Morfikov
|
||||
#
|
||||
# This program is free software; you can redistribute it and/or
|
||||
# modify it under the terms of version 2 of the GNU General Public
|
||||
# License published by the Free Software Foundation.
|
||||
#
|
||||
# ------------------------------------------------------------------
|
||||
|
||||
abi <abi/3.0>,
|
||||
|
||||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}lib/systemd/systemd-localed
|
||||
profile systemd-localed @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/systemd-common>
|
||||
|
||||
# Needed?
|
||||
audit deny capability net_admin,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
/etc/default/keyboard r,
|
||||
|
||||
/etc/default/locale rw,
|
||||
/etc/default/.#locale* rw,
|
||||
|
||||
/usr/share/systemd/language-fallback-map r,
|
||||
|
||||
}
|
||||
|
|
@ -21,7 +21,8 @@ profile systemd-modules-load @{exec_path} {
|
|||
# To load kernel modules
|
||||
capability sys_module,
|
||||
|
||||
capability net_admin,
|
||||
# Needed?
|
||||
audit deny capability net_admin,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
|
|||
|
|
@ -18,7 +18,8 @@ profile systemd-rfkill @{exec_path} {
|
|||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
|
||||
capability net_admin,
|
||||
# Needed?
|
||||
audit deny capability net_admin,
|
||||
|
||||
network netlink raw,
|
||||
|
||||
|
|
|
|||
|
|
@ -40,8 +40,8 @@ profile telegram-desktop @{exec_path} {
|
|||
network inet6 dgram,
|
||||
network inet stream,
|
||||
network inet6 stream,
|
||||
deny network netlink dgram,
|
||||
deny network netlink raw,
|
||||
network netlink dgram,
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
|
|||
|
|
@ -22,7 +22,7 @@ profile tint2 @{exec_path} {
|
|||
include <abstractions/deny-root-dir-access>
|
||||
include <abstractions/app-launcher-user>
|
||||
|
||||
deny network netlink dgram,
|
||||
network netlink dgram,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
|
|||
|
|
@ -20,6 +20,12 @@ profile wavemon @{exec_path} {
|
|||
# To scan WiFi networks
|
||||
capability net_admin,
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
# Needed to remove the following error:
|
||||
# wavemon: failed to connect to GeNetlink: Permission denied
|
||||
network netlink raw,
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
owner @{HOME}/.wavemonrc rw,
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@ abi <abi/3.0>,
|
|||
include <tunables/global>
|
||||
|
||||
@{exec_path} = /{usr/,}sbin/wrmsr
|
||||
profile wrmsr @{exec_path} flags=(complain) {
|
||||
profile wrmsr @{exec_path} {
|
||||
include <abstractions/base>
|
||||
|
||||
# To access /dev/cpu/*/msr .
|
||||
|
|
|
|||
Loading…
Reference in a new issue