mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-11-15 07:54:17 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

fixes

Browse Source
This commit is contained in:
nobodysu 2021-12-19 00:40:26 +03:00
parent 3101d9e7b6
commit b6e4b4b743
3 changed files with 31 additions and 39 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
apparmor.d/profiles-g-l/grc
View File

@ -1,4 +1,3 @@
# vim:syntax=apparmor
# apparmor.d - Full set of apparmor profiles
# SPDX-License-Identifier: GPL-2.0-only
@ -14,6 +13,14 @@ profile grc @{exec_path} {
include <abstractions/base>
include <abstractions/private-files-strict>
capability dac_read_search,
# No visible effect
deny capability dac_override,
signal (send) set=(int) peer=ss,
signal (send) set=(int) peer=ping,
signal (send) set=(int) peer=traceroute,
# python-strict
/{,usr/}lib{,32,64}/python3.[0-9]{,[0-9]}/**.{egg,py,pth} r,
/{,usr/}lib{,32,64}/python3.[0-9]{,[0-9]}/{site,dist}-packages/ r,
@ -23,7 +30,7 @@ profile grc @{exec_path} {
owner @{HOME}/.grc/** r,
/etc/grc.conf r,
/{,usr/}{,local/}share/grc/{,**} r,
/usr/{,local/}share/grc/{,**} r,
/{,usr/}bin/grcat rix,
/{,usr/}bin/cat rix,
@ -33,18 +40,18 @@ profile grc @{exec_path} {
/{,usr/}bin/{,e}grep rix,
/{,usr/}bin/sed rix,
/{,usr/}bin/less rix,
/{,usr/}bin/ls rix,
/{,usr/}bin/ping rPx,
/{,usr/}bin/traceroute rPx,
/{,usr/}bin/df rPx,
/{,usr/}bin/dfc rPx,
/{,usr/}bin/ss rPx,
/{,usr/}bin/ls rPx,
/{,usr/}bin/ps rPx,
/{,usr/}bin/ip rPx,
/{,usr/}bin/lsblk rPx,
/{,usr/}bin/diff rPx,
/{,usr/}sbin/blkid rPx,
/usr/{{bin,sbin}/traceroute,bin/linux-traceroute,bin/traceroute.db} rPx,
@{GRC_PATHS_RO}/** r,
@{MOUNTS}/** r,
@ -56,7 +63,7 @@ profile grc @{exec_path} {
audit deny /etc/ssh/ssh_host_*_key mrwkl,
# Noise
deny /{,usr/}bin/ r,
deny /usr/bin/ r,
include if exists <local/grc>
}

22
apparmor.d/profiles-g-l/ls
View File

@ -1,22 +0,0 @@
# vim:syntax=apparmor
# apparmor.d - Full set of apparmor profiles
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{,usr/}bin/ls
profile ls @{exec_path} {
@{exec_path} r,
include <abstractions/base>
include <abstractions/nameservice-strict>
capability dac_read_search,
# Directory traverse
/ r,
/**/ r,
include if exists <local/ls>
}

31
apparmor.d/profiles-s-z/ss
View File

@ -1,4 +1,3 @@
# vim:syntax=apparmor
# apparmor.d - Full set of apparmor profiles
# SPDX-License-Identifier: GPL-2.0-only
@ -18,22 +17,30 @@ profile ss @{exec_path} {
ptrace (read),
signal (receive) set=(int) peer=grc,
/etc/iproute2/{,**} r,
@{PROC} r,
@{PROC}/sys/net/ipv{4,6}/ip_local_port_range r,
@{PROC}/@{pid}/fd/ r,
@{PROC}/@{pid}/stat r,
@{PROC}/@{pid}/attr/current r,
@{PROC}/@{pid}/net/sockstat r,
@{PROC}/@{pid}/net/snmp r,
@{PROC} r,
@{PROC}/sys/net/ipv{4,6}/ip_local_port_range r,
@{PROC}/@{pid}/fd/ r,
@{PROC}/@{pid}/stat r,
@{PROC}/@{pid}/attr/current r,
owner @{PROC}/@{pid}/net/sockstat r,
owner @{PROC}/@{pid}/net/snmp r,
owner @{PROC}/@{pid}/net/unix r,
owner @{PROC}/@{pid}/net/raw r,
owner @{PROC}/@{pid}/net/tcp r,
owner @{PROC}/@{pid}/net/udp r,
# [e]xtended
owner @{PROC}/@{pid}/mounts r,
@{sys}/fs/cgroup/{,**/} r,
network netlink raw,
owner /tmp/*.ss rw,
owner @{HOME}/*.ss rw,
# [e]xtended
@{PROC}/@{pid}/mounts r,
@{sys}/fs/cgroup/{,**/} r,
include if exists <local/ss>
}