mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-18 08:58:15 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(profiles): add initial userns rule.

Browse source 
Require apparmor 4 to be enabled.
This commit is contained in:
Alexandre Pujol 2023-11-19 11:19:24 +00:00
parent 6dc990ac02
commit 88555a12d0
Failed to generate hash of commit
5 changed files with 11 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
apparmor.d/abstractions/chromium
View file

@ -31,6 +31,8 @@
include <abstractions/vulkan> include <abstractions/vulkan>
include <abstractions/wayland> include <abstractions/wayland>
# userns,
capability setgid, capability setgid,
capability setuid, capability setuid,
capability sys_admin, capability sys_admin,

2
apparmor.d/groups/virt/virtiofsd
View file

@ -10,6 +10,8 @@ include <tunables/global>
profile virtiofsd @{exec_path} { profile virtiofsd @{exec_path} {
include <abstractions/base> include <abstractions/base>
# userns,
capability chown, capability chown,
capability dac_override, capability dac_override,
capability dac_read_search, capability dac_read_search,

2
apparmor.d/profiles-s-z/slirp4netns
View file

@ -10,6 +10,8 @@ include <tunables/global>
profile slirp4netns @{exec_path} flags=(attach_disconnected) { profile slirp4netns @{exec_path} flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
# userns,
capability net_admin, capability net_admin,
capability setpcap, capability setpcap,
capability sys_admin, capability sys_admin,

2
apparmor.d/profiles-s-z/thunderbird
View file

@ -35,6 +35,8 @@ profile thunderbird @{exec_path} {
include <abstractions/vulkan> include <abstractions/vulkan>
include <abstractions/wayland> include <abstractions/wayland>
# userns,
capability sys_admin, # If kernel.unprivileged_userns_clone = 1 capability sys_admin, # If kernel.unprivileged_userns_clone = 1
capability sys_chroot, # If kernel.unprivileged_userns_clone = 1 capability sys_chroot, # If kernel.unprivileged_userns_clone = 1

8
pkg/prebuild/build.go
View file

@ -22,11 +22,9 @@ var (
regAttachments = regexp.MustCompile(`(profile .* @{exec_path})`) regAttachments = regexp.MustCompile(`(profile .* @{exec_path})`)
regFlags = regexp.MustCompile(`flags=\(([^)]+)\)`) regFlags = regexp.MustCompile(`flags=\(([^)]+)\)`)
regProfileHeader = regexp.MustCompile(` {`) regProfileHeader = regexp.MustCompile(` {`)
regAbi4To3 = util.ToRegexRepl([]string{ regAbi4To3 = util.ToRegexRepl([]string{ // Currently Abi3 -> Abi4
`abi/4.0`, `abi/3.0`, `abi/3.0`, `abi/4.0`,
`(?m)^.*mqueue.*$`, ``, `# userns,`, `userns,`,
`(?m)^.*userns.*$`, ``,
`(?m)^.*io_uring.*$`, ``,
}) })
) )