mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-11-15 16:03:51 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat(profile): add more whonix specific profile.

Browse Source
This commit is contained in:
Alexandre Pujol 2024-04-10 00:01:26 +01:00
parent a966cc0a93
commit a7f1973246
No known key found for this signature in database
GPG Key ID: C5469996F0DF68EC
2 changed files with 56 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
apparmor.d/groups/whonix/systemcheck-canary Normal file
View File

@ -0,0 +1,32 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/systemcheck/canary-daemon
profile systemcheck-canary @{exec_path} {
include <abstractions/base>
include <abstractions/nameservice-strict>
@{exec_path} mr,
@{bin}/sleep rix,
@{bin}/grep rix,
@{bin}/whoami rix,
@{bin}/cat rix,
@{bin}/date rix,
@{bin}/sleep rix,
@{lib}/systemcheck/canary rix,
#aa:stack systemd-detect-virt systemd-notify
@{bin}/systemd-detect-virt rPx -> &systemd-detect-virt,
@{bin}/systemd-notify rPx -> &systemd-notify,
@{PROC}/cmdline r,
include if exists <local/systemcheck-canary>
}

24
apparmor.d/groups/whonix/timesanitycheck Normal file
View File

@ -0,0 +1,24 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{bin}/timesanitycheck
profile timesanitycheck @{exec_path} {
include <abstractions/base>
include <abstractions/nameservice-strict>
@{exec_path} mr,
@{bin}/cat rix,
@{bin}/date rix,
/usr/share/timesanitycheck/{,**} r,
owner /dev/tty rw,
include if exists <local/timesanitycheck>
}