mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-18 08:58:15 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(full): simplify the service profiles.

Browse source
This commit is contained in:
Alexandre Pujol 2023-11-22 20:04:17 +00:00
parent 04513af863
commit ae99433595
Failed to generate hash of commit
3 changed files with 10 additions and 50 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
apparmor.d/groups/service/man-db.service
View file

@ -1,19 +0,0 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
# Profile for a systemd service, it does not specify an attachment path because
# it is intended to be used only via "Px -> *.service" exec transitions from systemd.service
abi <abi/3.0>,
include <tunables/global>
profile man-db.service @{exec_path} {
include <abstractions/base>
@{bin}/install mr,
@{bin}/find mr,
include if exists <local/man-db.service>
}

22
apparmor.d/groups/service/snapd.system-shutdown.service
View file

@ -1,22 +0,0 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
# Profile for a systemd service, it does not specify an attachment path because
# it is intended to be used only via "Px -> *.service" exec transitions from systemd.service
abi <abi/3.0>,
include <tunables/global>
profile snapd.system-shutdown.service @{exec_path} {
include <abstractions/base>
@{bin}/cp mr,
@{bin}/mkdir mr,
@{run}/initramfs/shutdown rw,
@{run}/initramfs/ rw,
include if exists <local/snapd.system-shutdown.service>
}

19
apparmor.d/groups/service/systemd.service
View file

@ -17,27 +17,24 @@ profile systemd.service @{exec_path} flags=(attach_disconnected) {
@{bin}/{,ba,da}sh rm, @{bin}/{,ba,da}sh rm,
@{bin}/cp rix,
@{bin}/find rix,
@{bin}/grep rix, @{bin}/grep rix,
@{bin}/grub-editenv rPx, @{bin}/install rix,
@{bin}/ibus-daemon rPx,
@{bin}/mkdir rix, @{bin}/mkdir rix,
@{bin}/mount rix, @{bin}/mount rix,
@{bin}/rm rix, @{bin}/rm rix,
@{bin}/systemctl rix, @{bin}/systemctl rix,
@{bin}/grub-editenv rPx,
@{bin}/ibus-daemon rPx,
@{bin}/chgrp rPx -> dmesg.service, @{bin}/chgrp rPx -> dmesg.service,
@{bin}/chmod rPx -> dmesg.service, @{bin}/chmod rPx -> dmesg.service,
@{bin}/savelog rPx -> dmesg.service, @{bin}/savelog rPx -> dmesg.service,
@{bin}/ldconfig rPx -> ldconfig.service, @{bin}/ldconfig rPx -> ldconfig.service,
@{bin}/find rPx -> man-db.service,
@{bin}/mandb rPx -> man-db.service,
@{bin}/install rPx -> man-db.service,
@{bin}/cp rPx -> snapd.system-shutdown.service,
@{bin}/mkdir rPx -> snapd.system-shutdown.service,
@{lib}/ r, @{lib}/ r,
/var/cache/ldconfig/aux-cache* rw, /var/cache/ldconfig/aux-cache* rw,
@ -46,6 +43,10 @@ profile systemd.service @{exec_path} flags=(attach_disconnected) {
/boot/grub/grubenv rw, /boot/grub/grubenv rw,
/boot/grub/ w, /boot/grub/ w,
# snapd.system-shutdown.service
@{run}/initramfs/shutdown rw,
@{run}/initramfs/ rw,
@{PROC}/cmdline r, @{PROC}/cmdline r,
@{PROC}/sys/kernel/osrelease r, @{PROC}/sys/kernel/osrelease r,