mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-18 00:48:10 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

update

Browse source
This commit is contained in:
nobodysu 2022-02-20 02:21:48 +03:00
parent 9df0bd07aa
commit b5cdd0af44
2 changed files with 19 additions and 10 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
apparmor.d/profiles-s-z/su
View file

@ -77,13 +77,13 @@ profile su @{exec_path} {
dbus (send) dbus (send)
bus=system bus=system
path=/org/freedesktop/login[1-9] path=/org/freedesktop/login[0-9]
interface=org.freedesktop.login[1-9].Manager interface=org.freedesktop.login[0-9].Manager
member={CreateSession,ReleaseSession}, member={CreateSession,ReleaseSession},
unix (bind) type=dgram, unix (bind) type=dgram,
owner /dev/tty[0-9]* rw, /dev/tty[0-9]* rw,
include if exists <local/su> include if exists <local/su>
} }

23
apparmor.d/profiles-s-z/sudo
View file

@ -1,11 +1,14 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov # Copyright (C) 2019-2021 Mikhail Morfikov
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>, abi <abi/3.0>,
include <tunables/global> include <tunables/global>
@{PATH} = /usr/local/sbin /usr/local/bin /usr/sbin /usr/bin /sbin /bin
@{exec_path} = /{usr/,}bin/sudo @{exec_path} = /{usr/,}bin/sudo
profile sudo @{exec_path} { profile sudo @{exec_path} {
include <abstractions/base> include <abstractions/base>
@ -27,27 +30,30 @@ profile sudo @{exec_path} {
capability sys_resource, capability sys_resource,
network netlink raw, network netlink raw,
# dns query?
# network inet dgram,
# network inet6 dgram,
ptrace (read), ptrace (read),
signal, signal,
signal (send) set=(cont,hup) peer=su, signal (send) set=(cont,hup) peer=su,
@{exec_path} mr, @{exec_path} mr,
@{libexec}/sudo/** mr,
# Shells to use # Shells to use
/{usr/,}bin/{,b,d,rb}ash rpux, /{usr/,}bin/{,b,d,rb}ash rpux,
/{usr/,}bin/{c,k,tc,z}sh rpux, /{usr/,}bin/{c,k,tc,z}sh rpux,
/{usr/,}bin/[a-z0-9]* rPUx, @{PATH}/[a-z0-9]* rPUx,
/{usr/,}{s,}bin/[a-z0-9]* rPUx,
/{usr/,}lib/cockpit/cockpit-askpass rPUx, /{usr/,}lib/cockpit/cockpit-askpass rPUx,
/etc/environment r,
/etc/machine-id r,
/etc/security/limits.d/{,*} r,
/etc/sudo.conf r, /etc/sudo.conf r,
/etc/sudoers r, /etc/sudoers r,
/etc/sudoers.d/{,*} r, /etc/sudoers.d/{,*} r,
/etc/environment r,
/etc/security/limits.d/{,*} r,
/etc/default/locale r, /etc/default/locale r,
/var/log/sudo.log wk, /var/log/sudo.log wk,
@ -60,11 +66,14 @@ profile sudo @{exec_path} {
@{PROC}/@{pids}/fd/ r, @{PROC}/@{pids}/fd/ r,
@{PROC}/@{pids}/stat r, @{PROC}/@{pids}/stat r,
@{PROC}/1/limits r,
# File Inherit # File Inherit
owner /dev/tty[0-9]* rw, owner /dev/tty[0-9]* rw,
owner @{HOME}/.xsession-errors w, owner @{HOME}/.xsession-errors w,
/var/lib/sudo/lectured/user rw,
owner @{HOME}/.sudo_as_admin_successful rw, owner @{HOME}/.sudo_as_admin_successful rw,
@{run}/systemd/userdb/ r, @{run}/systemd/userdb/ r,
@ -72,7 +81,7 @@ profile sudo @{exec_path} {
@{PROC}/sys/kernel/random/boot_id r, @{PROC}/sys/kernel/random/boot_id r,
# /dev/ r, # noise /dev/ r, # interactive login
/dev/ptmx rw, /dev/ptmx rw,
include if exists <local/sudo> include if exists <local/sudo>