mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-18 00:48:10 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Update acpid

Browse source 
Another case. Tested on Debian 11 and Ubuntu LTS.
This commit is contained in:
nobodysu 2022-01-10 21:29:53 +00:00 committed by GitHub
parent 5c1a1f6f8e
commit 80bd1028c5
Failed to generate hash of commit
1 changed files with 36 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

40
apparmor.d/profiles-a-f/acpid
View file

@ -22,7 +22,6 @@ profile acpid @{exec_path} flags=(attach_disconnected) {
/etc/acpi/{,**} r, /etc/acpi/{,**} r,
/etc/acpi/handler.sh rix, /etc/acpi/handler.sh rix,
/etc/acpi/powerbtn-acpi-support.sh rix,
/dev/input/{,**} r, /dev/input/{,**} r,
/dev/tty rw, /dev/tty rw,
@ -33,12 +32,43 @@ profile acpid @{exec_path} flags=(attach_disconnected) {
owner @{run}/acpid.socket rw, owner @{run}/acpid.socket rw,
owner @{run}/acpid.pid rw, owner @{run}/acpid.pid rw,
/etc/acpi/powerbtn-acpi-support.sh rPx -> acpid//powerbtn-acpi-support.sh,
include if exists <local/acpid>
}
profile acpid//powerbtn-acpi-support.sh flags=(attach_disconnected) {
/etc/acpi/powerbtn-acpi-support.sh r,
include <abstractions/base>
include <abstractions/wutmp>
capability sys_ptrace,
deny capability net_admin, # ??
ptrace (read), # unconfined, tighten later, TODO
deny / r,
@{PROC} r,
@{PROC}/uptime r,
@{PROC}/sys/kernel/osrelease r,
@{PROC}/@{pid}/stat r,
@{PROC}/@{pid}/cmdline r,
/usr/share/acpi-support/** r, /usr/share/acpi-support/** r,
# powerbtn-acpi-support.sh /{usr/,}bin/sed rix,
/{usr/,}bin/sed rix, /{usr/,}bin/pgrep rix,
/{usr/,}bin/{,e}grep rix,
/{usr/,}bin/pinky rix,
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/dbus-send rix,
/{usr/,}bin/systemctl rix,
/{usr/,}sbin/killall5 rix,
/{usr/,}sbin/shutdown rix,
/etc/acpi/powerbtn.sh rix,
/{usr/,}bin/ps rPx, /{usr/,}bin/ps rPx,
/{usr/,}bin/fgconsole rCx, /{usr/,}bin/fgconsole rCx,
profile fgconsole /usr/bin/fgconsole { profile fgconsole /usr/bin/fgconsole {
@ -51,5 +81,5 @@ profile acpid @{exec_path} flags=(attach_disconnected) {
owner /dev/tty[0-9]* rw, owner /dev/tty[0-9]* rw,
} }
include if exists <local/acpid> include if exists <local/powerbtn-acpi-support.sh>
} }