mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-19 01:18:16 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Rewrite the profile for ufw

Browse source
This commit is contained in:
EricLin0509 2024-08-27 21:00:20 +08:00 committed by Alex
parent d5ee5c51cb
commit 7716c8a191
1 changed files with 9 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
apparmor.d/profiles-s-z/ufw
View file

@ -8,8 +8,9 @@ include <tunables/global>
@{exec_path} = @{bin}/ufw @{exec_path} = @{bin}/ufw
profile ufw @{exec_path} { profile ufw @{exec_path} {
include <abstractions/base> include <abstractions/base>
include <abstractions/nameservice-strict>
include <abstractions/python>
capability dac_read_search, capability dac_read_search,
capability net_admin, capability net_admin,
@ -21,34 +22,28 @@ profile ufw @{exec_path} {
@{exec_path} mr, @{exec_path} mr,
@{bin}/ r, @{bin}/ r,
@{bin}/python3* ix, @{bin}/env r,
@{bin}/python3.@{int} ix,
@{bin}/cat ix, @{bin}/cat ix,
@{bin}/xtables-nft-multi ix, @{bin}/xtables-nft-multi ix,
@{lib}/ufw/ufw-init ix, @{lib}/ufw/ufw-init ix,
@{PROC}/@{pid}/stat r,
@{PROC}/@{pid}/fd/ r,
@{PROC}/@{pid}/net/ip_tables_names r,
owner @{bin}/env r,
/etc/ufw/{,**} rwk, /etc/ufw/{,**} rwk,
/etc/default/ufw r, /etc/default/ufw r,
/run/ufw.lock wk, @{run}/ufw.lock rwk,
/etc/gai.conf r,
/etc/nsswitch.conf r,
/etc/passwd r,
/etc/services r,
/var/tmp/@{rand8} rw, /var/tmp/@{rand8} rw,
/var/tmp/tmp* rw, /var/tmp/tmp* rw,
/tmp/@{rand8} rw, /tmp/@{rand8} rw,
/tmp/tmp* rw, /tmp/tmp* rw,
@{PROC}/@{pid}/stat r,
@{PROC}/@{pid}/fd/ r,
@{PROC}/@{pid}/net/ip_tables_names r,
/dev/pts/[0-9]* rw, /dev/pts/[0-9]* rw,
/dev/tty rw, /dev/tty rw,