mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-31 07:17:22 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(abs): update some abstractions.

Browse source
This commit is contained in:
Alexandre Pujol 2024-03-27 14:32:08 +00:00
parent c852fd3a01
commit 92f83d9e8d
Failed to generate hash of commit
3 changed files with 18 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
apparmor.d/abstractions/bwrap
View file

@ -23,7 +23,7 @@
mount options=(rw silent rslave) -> /, mount options=(rw silent rslave) -> /,
mount fstype=devpts options=(rw nosuid noexec) devpts -> /newroot/dev/pts/, mount fstype=devpts options=(rw nosuid noexec) devpts -> /newroot/dev/pts/,
mount fstype=proc options=(rw nosuid nodev noexec) proc -> /newroot/@{PROC}/, mount fstype=proc options=(rw nosuid nodev noexec) proc -> /newroot/@{PROC}/,
mount fstype=tmpfs options=(rw nosuid nodev) tmpfs -> /newroot/dev/, mount fstype=tmpfs options=(rw nosuid nodev) tmpfs -> /newroot/{,**},
mount fstype=tmpfs options=(rw nosuid nodev) tmpfs -> /tmp/, mount fstype=tmpfs options=(rw nosuid nodev) tmpfs -> /tmp/,
remount /newroot/{,**}, remount /newroot/{,**},

2
apparmor.d/abstractions/dconf-write
View file

@ -15,6 +15,8 @@
member=Notify member=Notify
peer=(name=:*, label=dconf-service), peer=(name=:*, label=dconf-service),
/usr/share/dconf/profile/gdm r,
/etc/dconf/** r, /etc/dconf/** r,
owner @{user_config_dirs}/dconf/user r, owner @{user_config_dirs}/dconf/user r,

15
apparmor.d/abstractions/sudo
View file

@ -11,6 +11,8 @@
include <abstractions/wutmp> include <abstractions/wutmp>
capability audit_write, capability audit_write,
capability dac_override,
capability dac_read_search,
capability net_admin, capability net_admin,
capability setgid, capability setgid,
capability setuid, capability setuid,
@ -27,6 +29,7 @@
interface=org.freedesktop.systemd.Manager interface=org.freedesktop.systemd.Manager
member={JobRemoved,StartTransientUnit}, member={JobRemoved,StartTransientUnit},
@{bin}/sudo mr,
@{lib}/sudo/** mr, @{lib}/sudo/** mr,
@{etc_ro}/environment r, @{etc_ro}/environment r,
@ -44,7 +47,17 @@
@{PROC}/sys/kernel/ngroups_max r, @{PROC}/sys/kernel/ngroups_max r,
@{PROC}/sys/kernel/seccomp/actions_avail r, @{PROC}/sys/kernel/seccomp/actions_avail r,
/dev/ r, # interactive login owner /var/lib/sudo/ts/ rw,
owner /var/lib/sudo/ts/@{uid} rwk,
owner /var/log/sudo.log wk,
@{run}/faillock/{,*} rwk,
owner @{run}/sudo/ rw,
owner @{run}/sudo/ts/ rw,
owner @{run}/sudo/ts/@{uid} rwk,
/dev/ r,
/dev/ptmx rwk, /dev/ptmx rwk,
/dev/tty rwk, /dev/tty rwk,
owner /dev/tty@{int} rw, owner /dev/tty@{int} rw,