mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-11-14 23:43:56 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat(abs): minor improvments.

Browse Source
This commit is contained in:
Alexandre Pujol 2024-03-10 14:56:18 +00:00
parent a8b8bf52f8
commit 8f1fff89ab
No known key found for this signature in database
GPG Key ID: C5469996F0DF68EC
2 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
apparmor.d/abstractions/bwrap
View File

@ -4,7 +4,9 @@
# Minimal set of rules for bwrap
# A profile using this abstaction still needs to include: @{bin}/bwrap rix,
# A profile using this abstaction still needs to set:
# - the attach_disconnected flag
# - bwrap execution: '@{bin}/bwrap rix,'
capability net_admin,
capability setpcap,
@ -36,10 +38,6 @@
owner /tmp/newroot/ w,
owner /tmp/oldroot/ w,
@{sys}/fs/cgroup/user.slice/cpu.max r,
@{sys}/fs/cgroup/user.slice/user-@{uid}.slice/cpu.max r,
@{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/app.slice/cpu.max r,
@{sys}/fs/cgroup/user.slice/user-@{uid}.slice/user@@{uid}.service/cpu.max r,
@{PROC}/sys/kernel/overflowgid r,
@{PROC}/sys/kernel/overflowuid r,

4
apparmor.d/abstractions/user-read
View File

@ -5,8 +5,10 @@
# This abstraction gives read access on all defined user directories. It should
# only be used if access to **ALL** folders is required.
owner @{HOME}/@{XDG_WALLPAPERS_DIR}/{,**} r,
owner @{HOME}/@{XDG_DESKTOP_DIR}/{,**} r,
owner @{HOME}/@{XDG_SCREENSHOTS_DIR}/{,**} r,
owner @{HOME}/@{XDG_WALLPAPERS_DIR}/{,**} r,
owner @{MOUNTS}/@{XDG_DESKTOP_DIR}/{,**} r,
owner @{MOUNTS}/@{XDG_SCREENSHOTS_DIR}/{,**} r,
owner @{MOUNTS}/@{XDG_WALLPAPERS_DIR}/{,**} r,