diff --git a/apparmor.d/groups/ssh/sshfs b/apparmor.d/groups/ssh/sshfs index 4ded5371..ff1c2b89 100644 --- a/apparmor.d/groups/ssh/sshfs +++ b/apparmor.d/groups/ssh/sshfs @@ -12,6 +12,8 @@ profile sshfs @{exec_path} flags=(complain) { @{exec_path} mr, + unix (connect, send, receive) type=stream peer=(label="sshfs//fusermount",addr=none), + /{usr/,}bin/ssh rPx, /{usr/,}bin/fusermount{,3} rCx -> fusermount, @@ -23,13 +25,15 @@ profile sshfs @{exec_path} flags=(complain) { @{PROC}/sys/fs/pipe-max-size r, - profile fusermount { + profile fusermount flags=(complain) { include include # To mount anything: capability sys_admin, + unix (connect, send, receive) type=stream peer=(label="sshfs",addr=none), + /{usr/,}bin/fusermount{,3} mr, mount fstype={fuse,fuse.sshfs} -> @{HOME}/*/,