mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-18 17:08:09 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(fsp): restrict @{run} for systemd.

Browse source
This commit is contained in:
Alexandre Pujol 2024-03-04 22:02:43 +00:00
parent 532162f302
commit 8ea0964724
Failed to generate hash of commit
1 changed files with 19 additions and 12 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

31
apparmor.d/groups/_full/systemd
View file

@ -19,6 +19,7 @@ profile systemd flags=(attach_disconnected,mediate_deleted) {
include <abstractions/base>
include <abstractions/authentication>
include <abstractions/bus-system>
include <abstractions/disks-read>
include <abstractions/nameservice-strict>
include <abstractions/wutmp>
@ -145,18 +146,24 @@ profile systemd flags=(attach_disconnected,mediate_deleted) {
/tmp/namespace-dev-@{rand6}/{,**} rw,
/tmp/systemd-private-*/{,**} rw,
@{run}/ r,
@{run}/credentials/{,**} rw,
@{run}/dbus/system_bus_socket rw,
@{run}/spice-vdagentd/spice-vdagent-sock rw,
@{run}/systemd/{,**} rw,
@{run}/udev/control rw,
@{run}/udev/data/* r,
@{run}/udev/tags/systemd/ r,
@{run}/user/@{uid}/{,**} rwlk,
owner @{run}/* rw,
owner @{run}/*/ rw,
owner @{run}/*/* rw,
@{run}/ rw,
@{run}/auditd.pid r,
@{run}/credentials/{,**} rw,
@{run}/initctl rw,
@{run}/spice-vdagentd/* rw,
@{run}/systemd/{,**} rw,
@{run}/udev/control rw,
@{run}/mount/ rw,
@{run}/mount/utab r,
@{run}/udev/data/+module:configfs r,
@{run}/udev/data/+module:fuse r,
@{run}/udev/data/c4:@{int} r, # For TTY devices
@{run}/udev/data/c10:@{int} r, # For non-serial mice, misc features
@{run}/udev/data/c116:@{int} r, # For ALSA
@{run}/udev/data/c@{dynamic}:@{int} r, # For dynamic assignment range 234 to 254, 384 to 511
@{run}/udev/data/n@{int} r,
@{run}/udev/tags/systemd/ r,
@{sys}/bus/ r,
@{sys}/class/ r,