mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-11-15 16:03:51 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat(whonix): add internal pam profiles.

Browse Source
This commit is contained in:
Alexandre Pujol 2024-04-05 23:28:50 +01:00
parent 14b779d29b
commit 7a3a856180
No known key found for this signature in database
GPG Key ID: C5469996F0DF68EC
5 changed files with 103 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
apparmor.d/abstractions/authentication.d/complete
View File

@ -1,2 +1,8 @@
@{bin}/unix_chkpwd rPx,
#aa:only whonix
@{bin}/pam-tmpdir-helper rPx,
@{lib}/security-misc/pam_faillock_not_if_x rPx,
@{lib}/security-misc/pam-abort-on-locked-password rPx,
@{lib}/security-misc/pam-info rPx,

23
apparmor.d/groups/whonix/pam-abort-on-locked-password Normal file
View File

@ -0,0 +1,23 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/security-misc/pam-abort-on-locked-password
profile pam-abort-on-locked-password @{exec_path} {
include <abstractions/base>
include <abstractions/nameservice-strict>
@{exec_path} mr,
@{sh_path} rix,
@{bin}/passwd rPx,
@{bin}/cut rix,
owner /dev/tty rw,
include if exists <local/pam-abort-on-locked-password>
}

30
apparmor.d/groups/whonix/pam-info Normal file
View File

@ -0,0 +1,30 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/security-misc/pam-info
profile pam-info @{exec_path} {
include <abstractions/base>
include <abstractions/nameservice-strict>
@{exec_path} mr,
@{sh_path} rix,
@{bin}/faillock rix,
@{bin}/grep rix,
@{bin}/str_replace rix,
@{bin}/wc rix,
@{bin}/whoami rix,
/etc/pam.d/* r,
@{run}/faillock/user rwk,
owner /dev/tty rw,
include if exists <local/pam-info>
}

24
apparmor.d/groups/whonix/pam-tmpdir-helper Normal file
View File

@ -0,0 +1,24 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{bin}/pam-tmpdir-helper
profile pam-tmpdir-helper @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
capability chown,
@{exec_path} mr,
owner /tmp/user/ rw,
owner /tmp/user/@{uid}/ rw,
/dev/ptmx rw,
include if exists <local/pam-tmpdir-helper>
}

20
apparmor.d/groups/whonix/pam_faillock_not_if_x Normal file
View File

@ -0,0 +1,20 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/security-misc/pam_faillock_not_if_x
profile pam_faillock_not_if_x @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/nameservice-strict>
@{exec_path} mr,
@{sh_path} rix,
include if exists <local/pam_faillock_not_if_x>
}