diff --git a/apparmor.d/profiles-a-f/findmnt b/apparmor.d/profiles-a-f/findmnt new file mode 100644 index 00000000..36c2cea5 --- /dev/null +++ b/apparmor.d/profiles-a-f/findmnt @@ -0,0 +1,22 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2022 Jeroen Rijken +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = /{usr/,}bin/findmnt +profile findmnt @{exec_path} flags=(complain) { + include + include + + @{exec_path} mr, + + /etc/fstab r, + /etc/mtab r, + + @{PROC}/@{pids}/mountinfo r, + + include if exists +} \ No newline at end of file diff --git a/apparmor.d/profiles-s-z/sanoid b/apparmor.d/profiles-s-z/sanoid new file mode 100644 index 00000000..8f4e7bbc --- /dev/null +++ b/apparmor.d/profiles-s-z/sanoid @@ -0,0 +1,32 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2022 Jeroen Rijken +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = /{usr/,}{local/,}{s,}bin/sanoid +profile sanoid @{exec_path} flags=(complain) { + include + include + + @{exec_path} rm, + /{usr/,}bin/{,ba,da}sh rix, + /{usr/,}bin/perl rix, + /{usr/,}bin/ps rPx, + /{usr/,}{local/,}{s,}bin/zfs rPx, + + /etc/sanoid/{*,} r, + + /var/cache/sanoid/snapshots.txt rw, + + /usr/share/sanoid/{**,} r, + + @{run}/sanoid/sanoid_cacheupdate.lock rwk, + @{run}/sanoid/sanoid_pruning.lock rwk, + + owner /tmp/** rw, + + include if exists +} diff --git a/apparmor.d/profiles-s-z/syncoid b/apparmor.d/profiles-s-z/syncoid new file mode 100644 index 00000000..0ca3f844 --- /dev/null +++ b/apparmor.d/profiles-s-z/syncoid @@ -0,0 +1,32 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2022 Jeroen Rijken +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = /{usr/,}{local/,}{s,}bin/syncoid +profile syncoid @{exec_path} flags=(complain) { + include + include + include + + @{exec_path} rm, + /{usr/,}bin/grep rix, + /{usr/,}bin/mbuffer rix, + /{usr/,}bin/perl rix, + /{usr/,}bin/ps rPx, + /{usr/,}bin/pv rix, + /{usr/,}bin/{,ba,da}sh rix, + /{usr/,}{local/,}{s,}bin/zfs rPx, + /{usr/,}{local/,}{s,}bin/zpool rPx, + + /etc/mbuffer.rc r, + + owner /tmp/** rw, + + @{PROC}/@{pids}/maps r, + + include if exists +} diff --git a/apparmor.d/profiles-s-z/users b/apparmor.d/profiles-s-z/users new file mode 100644 index 00000000..a62d14e7 --- /dev/null +++ b/apparmor.d/profiles-s-z/users @@ -0,0 +1,22 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2022 Jeroen Rijken +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = /{usr/,}bin/users +profile users @{exec_path} { + include + include + include + + @{exec_path} mr, + + /var/log/wtmp rk, + + @{run}/utmp rk, + + include if exists +} diff --git a/apparmor.d/profiles-s-z/whereis b/apparmor.d/profiles-s-z/whereis new file mode 100644 index 00000000..86a2075a --- /dev/null +++ b/apparmor.d/profiles-s-z/whereis @@ -0,0 +1,43 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2022 Jeroen Rijken +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = /{usr/,}bin/whereis +profile whereis @{exec_path} flags=(complain) { + include + include + + @{exec_path} mr, + + /{usr/,}{local/,}{s,}bin/ r, + /{usr/,}lib/go-*/bin/ r, + /{usr/,}{local/,}games/ r, + + /etc/ r, + + /{usr/,}lib{,32,64}/ r, + /usr/local/{,etc/,lib/} r, + /usr/include/ r, + /usr/share/ r, + /usr/share/info/{**,} r, + /usr/share/man/{**,} r, + /usr/src/{**,} r, + + @{libexec}/ r, + + /opt/ r, + /opt/cni/bin/ r, + /opt/containerd/bin/ r, + + /snap/bin/ r, + + owner @{HOME}/{.local/,}/{.,}bin/ r, + owner @{HOME}/.krew/bin/ r, + owner @{HOME}/go/bin/ r, + + include if exists +} diff --git a/apparmor.d/profiles-s-z/which b/apparmor.d/profiles-s-z/which new file mode 100644 index 00000000..32635f41 --- /dev/null +++ b/apparmor.d/profiles-s-z/which @@ -0,0 +1,29 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2022 Jeroen Rijken +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = /{usr/,}bin/which{.debianutils,} +profile which @{exec_path} flags=(complain) { + include + + @{exec_path} mr, + + /{usr/,}{local/,}{s,}bin/ r, + /{usr/,}lib/go-*/bin/ r, + /{usr/,}{local/,}games/ r, + + /opt/cni/bin/ r, + /opt/containerd/bin/ r, + + /snap/bin/ r, + + owner @{HOME}/{.local/,}/{.,}bin/ r, + owner @{HOME}/.krew/bin/ r, + owner @{HOME}/go/bin/ r, + + include if exists +} diff --git a/apparmor.d/profiles-s-z/whoami b/apparmor.d/profiles-s-z/whoami new file mode 100644 index 00000000..6dca3d67 --- /dev/null +++ b/apparmor.d/profiles-s-z/whoami @@ -0,0 +1,18 @@ +# apparmor.d - Full set of apparmor profiles +# Copyright (C) 2019-2021 Mikhail Morfikov +# SPDX-License-Identifier: GPL-2.0-only + +abi , + +include + +@{exec_path} = /{usr/,}bin/whoami +profile whoami @{exec_path} { + include + include + include + + @{exec_path} mr, + + include if exists +}