mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-02-20 17:05:36 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Update profiles.

Browse source
This commit is contained in:
Alexandre Pujol 2021-08-22 15:32:42 +01:00
parent f922a5f8e8
commit b2d3af8bca
Failed to generate hash of commit
26 changed files with 57 additions and 37 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
apparmor.d/groups/gnome/gnome-control-center
View file

@ -80,6 +80,7 @@ profile gnome-control-center @{exec_path} flags=(attach_disconnected) {
@{run}/udev/data/+pci* r,
@{run}/udev/data/c13:[0-9]* r, # for /dev/input/*
@{run}/udev/data/c235:[0-9]* r,
@{run}/udev/data/c236:[0-9]* r,
@{run}/udev/data/n[0-9]* r,
@{sys}/bus/ r,

4
apparmor.d/groups/gpg/gpg
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2017-2021 Mikhail Morfikov
# 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -27,6 +28,9 @@ profile gpg @{exec_path} {
owner @{HOME}/@{XDG_GPG_DIR}/ rw,
owner @{HOME}/@{XDG_GPG_DIR}/** rwkl -> @{HOME}/@{XDG_GPG_DIR}/**,
owner @{HOME}/@{XDG_PROJECTS_DIR}/**/gnupg/ rw,
owner @{HOME}/@{XDG_PROJECTS_DIR}/**/gnupg/** rwkl -> @{HOME}/@{XDG_PROJECTS_DIR}/**/gnupg/**,
owner /var/lib/*/gnupg/ rw,
owner /var/lib/*/gnupg/** rwkl -> /var/lib/*/gnupg/**,

12
apparmor.d/groups/gpg/gpg-agent
View file

@ -27,6 +27,18 @@ profile gpg-agent @{exec_path} {
owner @{HOME}/@{XDG_GPG_DIR}/private-keys-v1.d/[0-9A-F]*.key rw,
owner @{HOME}/@{XDG_GPG_DIR}/S.gpg-agent{,.ssh,.browser,.extra} rw,
owner @{HOME}/@{XDG_PROJECTS_DIR}/**/{.,}gnupg/ rw,
owner @{HOME}/@{XDG_PROJECTS_DIR}/**/{.,}gnupg/gpg-agent.conf r,
owner @{HOME}/@{XDG_PROJECTS_DIR}/**/{.,}gnupg/private-keys-v1.d/ rw,
owner @{HOME}/@{XDG_PROJECTS_DIR}/**/{.,}gnupg/private-keys-v1.d/[0-9A-F]*.key rw,
owner @{HOME}/@{XDG_PROJECTS_DIR}/**/{.,}gnupg/S.gpg-agent{,.ssh,.browser,.extra} rw,
owner @{user_tmp_dirs}/**/{.,}gnupg/ rw,
owner @{user_tmp_dirs}/**/{.,}gnupg/gpg-agent.conf r,
owner @{user_tmp_dirs}/**/{.,}gnupg/private-keys-v1.d/ rw,
owner @{user_tmp_dirs}/**/{.,}gnupg/private-keys-v1.d/[0-9A-F]*.key rw,
owner @{user_tmp_dirs}/**/{.,}gnupg/S.gpg-agent{,.ssh,.browser,.extra} rw,
owner /var/lib/*/.gnupg/ rw,
owner /var/lib/*/.gnupg/private-keys-v1.d/ rw,
owner /var/lib/*/.gnupg/private-keys-v1.d/[0-9A-F]*.key rw,

2
apparmor.d/groups/systemd/bootctl
View file

@ -51,7 +51,7 @@ profile bootctl @{exec_path} {
owner @{PROC}/@{pid}/cgroup r,
@{PROC}/sys/kernel/random/poolsize r,
# Silencer
# Inherit silencer
deny network inet6 stream,
deny network inet stream,

4
apparmor.d/groups/systemd/systemd-detect-virt
View file

@ -20,9 +20,5 @@ profile systemd-detect-virt @{exec_path} flags=(attach_disconnected) {
@{sys}/devices/virtual/dmi/id/board_vendor r,
@{sys}/devices/virtual/dmi/id/bios_vendor r,
# Silencer
deny network inet6 stream,
deny network inet stream,
include if exists <local/systemd-detect-virt>
}

5
apparmor.d/groups/systemd/systemd-environment-d-generator
View file

@ -14,9 +14,14 @@ profile systemd-environment-d-generator @{exec_path} {
@{exec_path} mr,
/{usr/,}bin/gpgconf rPx,
/{usr/,}bin/mawk rix,
/etc/environment r,
owner @{user_config_dirs}/environment.d/{,*.conf} r,
/dev/tty rw,
include if exists <local/systemd-environment-d-generator>
}

4
apparmor.d/groups/systemd/systemd-hwdb
View file

@ -19,9 +19,5 @@ profile systemd-hwdb @{exec_path} {
owner @{PROC}/@{pid}/stat r,
# Silencer
deny network inet6 stream,
deny network inet stream,
include if exists <local/systemd-hwdb>
}

4
apparmor.d/groups/systemd/systemd-sysctl
View file

@ -27,9 +27,5 @@ profile systemd-sysctl @{exec_path} {
/etc/sysctl.conf r,
# Silencer
deny network inet6 stream,
deny network inet stream,
include if exists <local/systemd-sysctl>
}

4
apparmor.d/groups/systemd/systemd-sysusers
View file

@ -37,9 +37,5 @@ profile systemd-sysusers @{exec_path} {
owner @{PROC}/@{pid}/stat r,
@{PROC}/sys/kernel/random/boot_id r,
# Silencer
deny network inet6 stream,
deny network inet stream,
include if exists <local/systemd-sysusers>
}

5
apparmor.d/groups/systemd/systemd-tmpfiles
View file

@ -13,6 +13,7 @@ profile systemd-tmpfiles @{exec_path} {
include <abstractions/nameservice-strict>
capability chown,
capability dac_override,
capability dac_read_search,
capability fowner,
capability fsetid,
@ -49,9 +50,5 @@ profile systemd-tmpfiles @{exec_path} {
@{PROC}/@{pid}/net/unix r,
# Silencer
deny network inet6 stream,
deny network inet stream,
include if exists <local/systemd-tmpfiles>
}

4
apparmor.d/groups/systemd/systemd-udevd
View file

@ -97,9 +97,5 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected complain) {
# file_inherit
owner @{HOME}/.xsession-errors w,
# Silencer
deny network inet6 stream,
deny network inet stream,
include if exists <local/systemd-udevd>
}

2
apparmor.d/groups/systemd/systemd-xdg-autostart-generator
View file

@ -12,6 +12,8 @@ profile systemd-xdg-autostart-generator @{exec_path} {
include <abstractions/systemd-common>
include <abstractions/nameservice-strict>
capability net_admin,
@{exec_path} mr,
/etc/xdg/autostart/{,*.desktop} r,

3
apparmor.d/profiles-a-l/aa-status
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/aa-status
@{exec_path} = /{usr/,}{s,}bin/aa-status
profile aa-status @{exec_path} {
include <abstractions/base>
@ -22,6 +22,7 @@ profile aa-status @{exec_path} {
@{PROC}/ r,
@{PROC}/@{pids}/attr/apparmor/current r,
@{PROC}/@{pids}/attr/current r,
owner @{PROC}/@{pid}/mounts r,
include if exists <local/aa-status>

2
apparmor.d/profiles-a-l/auditd
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/auditd
@{exec_path} = /{usr/,}{s,}bin/auditd
profile auditd @{exec_path} {
include <abstractions/base>
include <abstractions/nameservice-strict>

8
apparmor.d/profiles-a-l/borg
View file

@ -62,6 +62,8 @@ profile borg @{exec_path} {
owner /tmp/* rw,
owner /tmp/tmp*/ rw,
owner /tmp/tmp*/idx rw,
owner /tmp/borg-cache-*/ rw,
owner /tmp/borg-cache-*/* rw,
owner /var/tmp/* rw,
owner /var/tmp/tmp*/ rw,
owner /var/tmp/tmp*/idx rw,
@ -111,10 +113,16 @@ profile borg @{exec_path} {
/{usr/,}bin/fusermount{,3} mr,
/etc/fuse.conf r,
umount @{MOUNTS}/*/,
umount @{MOUNTS}/*/*/,
owner @{PROC}/@{pid}/mounts r,
/dev/fuse rw,
}
include if exists <distribution/borg.d>
include if exists <local/borg>
}

7
apparmor.d/profiles-a-l/dhclient-script
View file

@ -13,6 +13,8 @@ profile dhclient-script @{exec_path} {
include <abstractions/openssl>
include <abstractions/ssl_certs>
capability sys_admin,
# Needed?
audit deny capability sys_module,
@ -20,7 +22,9 @@ profile dhclient-script @{exec_path} {
/{usr/,}bin/{,ba,da}sh mrix,
/{usr/,}bin/mkdir rix,
/{usr/,}bin/ping rPx,
/{usr/,}bin/chronyc rPUx,
/{usr/,}bin/run-parts rCx -> run-parts,
# To remove the following error:
@ -82,6 +86,9 @@ profile dhclient-script @{exec_path} {
# For ntpd/ntpsec
@{run}/systemd/netif/leases/ r,
# For chrony
@{run}/chrony-dhcp/ rw,
# file_inherit
/var/lib/dhcp/dhclient.leases r,

3
apparmor.d/profiles-a-l/eject
View file

@ -11,6 +11,7 @@ profile eject @{exec_path} {
include <abstractions/base>
include <abstractions/disks-write>
capability sys_admin,
capability sys_rawio,
@{exec_path} mr,
@ -24,5 +25,7 @@ profile eject @{exec_path} {
/etc/fstab r,
@{run}/mount/utab r,
include if exists <local/eject>
}

4
apparmor.d/profiles-a-l/gio-querymodules
View file

@ -15,9 +15,5 @@ profile gio-querymodules @{exec_path} {
/{usr/,}lib/gtk-{3,4}.0/**/giomodule.cache{,.[0-9A-Z]*} w,
# Silencer
deny network inet6 stream,
deny network inet stream,
include if exists <local/gio-querymodules>
}

2
apparmor.d/profiles-a-l/gtk-query-immodules
View file

@ -15,7 +15,7 @@ profile gtk-query-immodules @{exec_path} {
/{usr/,}lib/gtk-{3,4}.0/**/immodules.cache w,
/{usr/,}lib/gtk-{3,4}.0/**/immodules.cache.[0-9A-Z]* w,
# Silencer
# Inherit silencer
deny network inet6 stream,
deny network inet stream,

2
apparmor.d/profiles-a-l/ifup
View file

@ -53,6 +53,7 @@ profile ifup @{exec_path} {
/etc/network/if-post-down.d/ r,
/etc/network/if-post-down.d/bridge rPUx,
/etc/network/if-post-down.d/hostapd rPUx,
/etc/network/if-post-down.d/chrony rPUx,
/etc/hostapd/ifupdown.sh rPUx,
/etc/network/if-post-down.d/ifenslave rPUx,
/etc/network/if-post-down.d/macchanger rPUx,
@ -75,6 +76,7 @@ profile ifup @{exec_path} {
/etc/network/if-up.d/ r,
/etc/network/if-up.d/ethtool rPUx,
/etc/network/if-up.d/ifenslave rPUx,
/etc/network/if-up.d/chrony rPUx,
/etc/network/if-up.d/openvpn rPUx,
/etc/network/if-up.d/wpasupplicant rPUx,

2
apparmor.d/profiles-a-l/install-info
View file

@ -22,7 +22,7 @@ profile install-info @{exec_path} {
/dev/tty rw,
# Silencer
# Inherit silencer
deny network inet6 stream,
deny network inet stream,

2
apparmor.d/profiles-m-z/run-parts
View file

@ -50,6 +50,8 @@ profile run-parts @{exec_path} {
/{usr/,}bin/uname rix,
/{usr/,}bin/cat rix,
/usr/share/unattended-upgrades/update-motd-unattended-upgrades rix,
}
profile kernel-pre-post {

2
apparmor.d/profiles-m-z/update-ca-trust
View file

@ -32,7 +32,7 @@ profile update-ca-trust @{exec_path} {
/dev/tty rw,
# Silencer
# Inherit silencer
deny network inet6 stream,
deny network inet stream,

2
apparmor.d/profiles-m-z/update-desktop-database
View file

@ -20,7 +20,7 @@ profile update-desktop-database @{exec_path} {
/usr/share/*/*.desktop r,
# Silencer
# Inherit silencer
deny network inet6 stream,
deny network inet stream,

2
apparmor.d/profiles-m-z/update-mime-database
View file

@ -14,7 +14,7 @@ profile update-mime-database @{exec_path} {
/usr/share/mime/{,**} rw,
# Silencer
# Inherit silencer
deny network inet6 stream,
deny network inet stream,

2
apparmor.d/profiles-m-z/vlc-cache-gen
View file

@ -15,7 +15,7 @@ profile vlc-cache-gen @{exec_path} {
/{usr/,}lib/vlc/plugins/{,*} rw,
# Silencer
# Inherit silencer
deny network inet6 stream,
deny network inet stream,