mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-18 08:58:15 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(profiles): update snap profiles.

Browse source
This commit is contained in:
Alexandre Pujol 2023-09-05 23:33:58 +01:00
parent 245db40b2d
commit 7b4979cc63
Failed to generate hash of commit
6 changed files with 34 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
apparmor.d/profiles-s-z/snap
View file

@ -6,8 +6,8 @@ abi <abi/3.0>,
include <tunables/global>
@{bin_dirs} = @{bin}/ /snap/snapd/@{int}@{bin}/
@{lib_dirs} = @{lib}/ /snap/snapd/@{int}@{lib}/
@{bin_dirs} = @{bin}/ /snap/snapd/@{int}@{bin}
@{lib_dirs} = @{lib}/ /snap/snapd/@{int}@{lib}
@{exec_path} = @{bin_dirs}/snap
profile snap @{exec_path} {
@ -23,7 +23,7 @@ profile snap @{exec_path} {
unix (send, receive) type=stream peer=(label=apt),
mount options=(ro, silent) -> /tmp/snapd-auto-import-mount-[0-9]*/,
mount options=(ro, silent) -> /tmp/snapd-auto-import-mount-@{int}/,
dbus (send, receive) bus=session path=/org/freedesktop/
interface=org.freedesktop.systemd1.Manager
@ -34,6 +34,9 @@ profile snap @{exec_path} {
interface=org.freedesktop.systemd1.Manager
member={StartTransientUnit,JobRemoved},
dbus (send, receive) bus=system path=/org/freedesktop/systemd1
interface=org.freedesktop.systemd1.Manager,
dbus send bus=session path=/org/freedesktop/portal/documents
interface=org.freedesktop.portal.Documents
member=GetMountPoint
@ -59,8 +62,9 @@ profile snap @{exec_path} {
@{HOME}/snap/{,**} rw,
owner /tmp/snapd-auto-import-mount-[0-9]*/ rw,
owner /tmp/snapd-auto-import-mount-@{int}/ rw,
@{run}/user/@{uid}/bus rw,
owner @{run}/user/@{uid}/.mutter-Xwaylandauth.[0-9A-Z]* r,
owner @{run}/user/@{uid}/gdm/Xauthority r,
owner @{run}/user/@{uid}/snapd-session-agent.socket rw,

2
apparmor.d/profiles-s-z/snap-discard-ns
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global>
@{lib_dirs} = @{lib}/ /snap/snapd/@{int}@{lib}/
@{lib_dirs} = @{lib}/ /snap/snapd/@{int}@{lib}
@{exec_path} = @{lib_dirs}/snapd/snap-discard-ns
profile snap-discard-ns @{exec_path} {

2
apparmor.d/profiles-s-z/snap-failure
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global>
@{lib_dirs} = @{lib}/ /snap/snapd/@{int}@{lib}/
@{lib_dirs} = @{lib}/ /snap/snapd/@{int}@{lib}
@{exec_path} = @{lib_dirs}/snapd/snap-failure
profile snap-failure @{exec_path} {

2
apparmor.d/profiles-s-z/snap-seccomp
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global>
@{lib_dirs} = @{lib}/ /snap/snapd/@{int}@{lib}/
@{lib_dirs} = @{lib}/ /snap/snapd/@{int}@{lib}
@{exec_path} = @{lib_dirs}/snapd/snap-seccomp
profile snap-seccomp @{exec_path} {

13
apparmor.d/profiles-s-z/snap-update-ns
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global>
@{lib_dirs} = @{lib}/ /snap/snapd/@{int}@{lib}/
@{lib_dirs} = @{lib}/ /snap/snapd/@{int}@{lib}
@{exec_path} = @{lib_dirs}/snapd/snap-update-ns
profile snap-update-ns @{exec_path} {
@ -31,14 +31,21 @@ profile snap-update-ns @{exec_path} {
/var/lib/snapd/mount/{,*} r,
/ r,
/snap/{,**} rw,
/tmp/ r,
/tmp/.snap/{,**} rwk,
owner /snap/{,**} rw,
owner /var/ rw,
owner /var/snap/ rw,
owner /var/snap/**/ rw,
owner /tmp/.snap/{,**} rwk,
@{run}/snapd/lock/*.lock rwk,
@{run}/snapd/ns/{,**} rw,
@{sys}/fs/cgroup/{,**/} r,
@{sys}/fs/cgroup/system.slice/snap.*.service/cgroup.freeze rw,
@{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/snap*.service/cgroup.freeze rw,
@{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r,

16
apparmor.d/profiles-s-z/snapd
View file

@ -6,8 +6,8 @@ abi <abi/3.0>,
include <tunables/global>
@{bin_dirs} = @{bin}/ /snap/snapd/@{int}@{bin}/
@{lib_dirs} = @{lib}/ /snap/snapd/@{int}@{lib}/
@{bin_dirs} = @{bin}/ /snap/snapd/@{int}@{bin}
@{lib_dirs} = @{lib}/ /snap/snapd/@{int}@{lib}
@{exec_path} = @{lib_dirs}/snapd/snapd
profile snapd @{exec_path} {
@ -74,6 +74,7 @@ profile snapd @{exec_path} {
@{bin}/cp rix,
@{bin}/gzip rix,
@{bin}/journalctl rPx,
@{bin}/kmod rPx,
@{bin}/mount rix,
@{bin}/runuser rCx -> runuser,
@{bin}/snap rPx,
@ -87,7 +88,7 @@ profile snapd @{exec_path} {
@{bin}/update-desktop-database rPx,
@{bin_dirs}/fc-cache-* mr,
@{bin_dirs}/snap rPx,
@{bin_dirs}/snap rPx -> snap,
@{bin_dirs}/xdelta3 rix,
@{lib_dirs}/@{multiarch}/** mr,
@{lib_dirs}/@{multiarch}/ld-*.so rix,
@ -108,6 +109,7 @@ profile snapd @{exec_path} {
/etc/mime.types r,
/etc/modprobe.d/{,**/} r,
/etc/modules-load.d/{,**/} r,
/etc/modules-load.d/*snap* rw,
/etc/systemd/system/{,**/} r,
/etc/systemd/system/snap* rw,
/etc/systemd/user/{,**/} r,
@ -177,5 +179,13 @@ profile snapd @{exec_path} {
/dev/loop-control rw,
profile runuser {
include <abstractions/base>
@{bin}/runuser mr,
include if exists <local/snapd_runuser>
}
include if exists <local/snapd>
}