mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2025-01-18 17:08:09 +01:00
refractor(abs): move common and app abstraction to their own abstractions subfolder.
As the number of abstraction is increasing, it is valuable to separate "base" abstractions to programs specific ones.
This commit is contained in:
Alexandre Pujol
parent
92f83d9e8d
commit
b88b8b8c26
158 changed files with 226 additions and 198 deletions
|
|
@ -3,7 +3,7 @@
|
|||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
# For chromium based browser. If your application requires chromium to run
|
||||
# (like electron) use abstractions/chromium-common instead.
|
||||
# (like electron) use abstractions/common/chromium instead.
|
||||
|
||||
# This abstraction requires the following variables definied in the profile header:
|
||||
# @{name} = chromium
|
||||
|
|
@ -209,4 +209,4 @@
|
|||
deny @{lib_dirs}/** w,
|
||||
deny @{user_share_dirs}/gvfs-metadata/* r,
|
||||
|
||||
include if exists <abstractions/chromium.d>
|
||||
include if exists <abstractions/app/chromium.d>
|
||||
|
|
@ -64,4 +64,4 @@
|
|||
|
||||
deny @{user_share_dirs}/gvfs-metadata/* r,
|
||||
|
||||
include if exists <abstractions/sudo.d>
|
||||
include if exists <abstractions/app/sudo.d>
|
||||
|
|
@ -2,6 +2,7 @@
|
|||
# Copyright (C) 2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/consoles>
|
||||
|
||||
ptrace (read) peer=@{systemd},
|
||||
|
|
@ -24,4 +25,4 @@
|
|||
owner @{PROC}/@{pid}/fd/ r,
|
||||
owner @{PROC}/@{pid}/stat r,
|
||||
|
||||
include if exists <abstractions/systemctl.d>
|
||||
include if exists <abstractions/app/systemctl.d>
|
||||
|
|
@ -13,9 +13,6 @@
|
|||
include <abstractions/bus-session>
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/bus/org.a11y>
|
||||
include <abstractions/bus/org.freedesktop.Avahi>
|
||||
include <abstractions/bus/org.freedesktop.NetworkManager>
|
||||
include <abstractions/bus/org.freedesktop.portal.Desktop>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/deny-sensitive-home>
|
||||
include <abstractions/desktop>
|
||||
|
|
@ -55,8 +52,7 @@
|
|||
owner @{run}/user/@{uid}/{,**} rw,
|
||||
owner @{user_config_dirs}/** rwkl,
|
||||
owner @{user_share_dirs}/** rwkl,
|
||||
|
||||
@{user_games_dirs}/{,**} rm,
|
||||
owner @{user_games_dirs}/{,**} rm,
|
||||
|
||||
owner /tmp/** rmwk,
|
||||
owner /dev/shm/** rwlk -> /dev/shm/**,
|
||||
|
|
@ -114,4 +110,4 @@
|
|||
/dev/pts/ptmx rw,
|
||||
/dev/tty rw,
|
||||
|
||||
include if exists <abstractions/bwrap-app.d>
|
||||
include if exists <abstractions/common/app.d>
|
||||
|
|
@ -25,7 +25,7 @@
|
|||
/var/lib/dpkg/status r,
|
||||
/var/lib/ubuntu-advantage/apt-esm/{,**} r,
|
||||
|
||||
owner /tmp/clearsigned.message.* rw,
|
||||
owner /tmp/#@{int} rw,
|
||||
owner /tmp/clearsigned.message.* rw,
|
||||
|
||||
include if exists <abstractions/apt-common.d>
|
||||
include if exists <abstractions/common/apt.d>
|
||||
|
|
@ -51,4 +51,4 @@
|
|||
owner @{PROC}/@{pid}/setgroups rw,
|
||||
owner @{PROC}/@{pid}/uid_map rw,
|
||||
|
||||
include if exists <abstractions/bwrap.d>
|
||||
include if exists <abstractions/common/bwrap.d>
|
||||
40
apparmor.d/abstractions/common/chromium
Normal file
40
apparmor.d/abstractions/common/chromium
Normal file
|
|
@ -0,0 +1,40 @@
|
|||
# apparmor.d - Full set of apparmor profiles
|
||||
# Copyright (C) 2022 Mikhail Morfikov
|
||||
# Copyright (C) 2022-2024 Alexandre Pujol <alexandre@pujol.io>
|
||||
# SPDX-License-Identifier: GPL-2.0-only
|
||||
|
||||
# This abstraction is for chromium based application. Chromium based browsers
|
||||
# need to use abstractions/chromium instead.
|
||||
|
||||
# userns,
|
||||
|
||||
# Only needed when kernel.unprivileged_userns_clone is set to "1"
|
||||
capability sys_admin,
|
||||
capability sys_chroot,
|
||||
capability setuid,
|
||||
capability setgid,
|
||||
owner @{PROC}/@{pid}/setgroups w,
|
||||
owner @{PROC}/@{pid}/gid_map w,
|
||||
owner @{PROC}/@{pid}/uid_map w,
|
||||
|
||||
owner @{HOME}/.pki/ rw,
|
||||
owner @{HOME}/.pki/nssdb/ rw,
|
||||
owner @{HOME}/.pki/nssdb/pkcs11.txt rw,
|
||||
owner @{HOME}/.pki/nssdb/{cert9,key4}.db rwk,
|
||||
owner @{HOME}/.pki/nssdb/{cert9,key4}.db-journal rw,
|
||||
|
||||
owner @{user_share_dirs}/.org.chromium.Chromium.* rw,
|
||||
|
||||
/tmp/ r,
|
||||
/var/tmp/ r,
|
||||
owner /tmp/.org.chromium.Chromium.* rw,
|
||||
owner /tmp/.org.chromium.Chromium.*/{,**} rw,
|
||||
owner /tmp/scoped_dir*/ rw,
|
||||
owner /tmp/scoped_dir*/SingletonCookie w,
|
||||
owner /tmp/scoped_dir*/SingletonSocket w,
|
||||
owner /tmp/scoped_dir*/SS w,
|
||||
|
||||
/dev/shm/ r,
|
||||
owner /dev/shm/.org.chromium.Chromium.* rw,
|
||||
|
||||
include if exists <abstractions/common/chromium.d>
|
||||
|
|
@ -18,4 +18,4 @@
|
|||
|
||||
/dev/kmsg w,
|
||||
|
||||
include if exists <abstractions/systemd-common.d>
|
||||
include if exists <abstractions/common/systemd.d>
|
||||
|
|
@ -11,8 +11,8 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/bwrap
|
||||
profile bwrap @{exec_path} flags=(attach_disconnected,mediate_deleted) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/bwrap>
|
||||
include <abstractions/bwrap-app>
|
||||
include <abstractions/common/bwrap>
|
||||
include <abstractions/common/app>
|
||||
include <abstractions/dbus>
|
||||
include <abstractions/fontconfig-cache-write>
|
||||
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
|
||||
profile bwrap-app flags=(attach_disconnected,mediate_deleted) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/bwrap-app>
|
||||
include <abstractions/common/app>
|
||||
include <abstractions/fontconfig-cache-write>
|
||||
|
||||
network inet dgram,
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@ include <tunables/global>
|
|||
|
||||
profile default-sudo @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/sudo>
|
||||
include <abstractions/app/sudo>
|
||||
|
||||
capability chown,
|
||||
capability dac_override,
|
||||
|
|
|
|||
|
|
@ -19,7 +19,7 @@ profile calibre @{exec_path} {
|
|||
include <abstractions/bus-session>
|
||||
include <abstractions/bus/org.a11y>
|
||||
include <abstractions/bus/org.gtk.vfs.MountTracker>
|
||||
include <abstractions/chromium-common>
|
||||
include <abstractions/common/chromium>
|
||||
include <abstractions/devices-usb>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/fonts>
|
||||
|
|
|
|||
|
|
@ -27,7 +27,7 @@ profile discord @{exec_path} {
|
|||
include <abstractions/mesa>
|
||||
include <abstractions/user-download-strict>
|
||||
include <abstractions/thumbnails-cache-read>
|
||||
include <abstractions/chromium-common>
|
||||
include <abstractions/common/chromium>
|
||||
|
||||
signal (send) set=(kill, term) peer=@{profile_name}//lsb_release,
|
||||
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@ include <tunables/global>
|
|||
profile freetube @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/audio-client>
|
||||
include <abstractions/chromium-common>
|
||||
include <abstractions/common/chromium>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/dconf-write>
|
||||
include <abstractions/desktop>
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@ include <tunables/global>
|
|||
profile signal-desktop @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/audio-client>
|
||||
include <abstractions/chromium-common>
|
||||
include <abstractions/common/chromium>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/fonts>
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/apt @{bin}/apt-get @{bin}/aptd
|
||||
profile apt @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/apt-common>
|
||||
include <abstractions/common/apt>
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/bus/org.freedesktop.login1>
|
||||
include <abstractions/bus/org.freedesktop.PackageKit>
|
||||
|
|
@ -220,7 +220,7 @@ profile apt @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
profile systemctl {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemctl>
|
||||
include <abstractions/app/systemctl>
|
||||
|
||||
capability net_admin,
|
||||
capability sys_resource,
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/apt-cache
|
||||
profile apt-cache @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/apt-common>
|
||||
include <abstractions/common/apt>
|
||||
include <abstractions/consoles>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/apt-cdrom
|
||||
profile apt-cdrom @{exec_path} flags=(complain) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/apt-common>
|
||||
include <abstractions/common/apt>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability dac_read_search,
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/apt-config
|
||||
profile apt-config @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/apt-common>
|
||||
include <abstractions/common/apt>
|
||||
include <abstractions/consoles>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@ include <tunables/global>
|
|||
profile apt-extracttemplates @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/apt-common>
|
||||
include <abstractions/common/apt>
|
||||
|
||||
capability dac_read_search,
|
||||
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/apt-file
|
||||
profile apt-file @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/apt-common>
|
||||
include <abstractions/common/apt>
|
||||
include <abstractions/perl>
|
||||
|
||||
@{exec_path} r,
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/apt-forktracer
|
||||
profile apt-forktracer @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/apt-common>
|
||||
include <abstractions/common/apt>
|
||||
include <abstractions/python>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/apt/apt-helper
|
||||
profile apt-helper @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/apt-common>
|
||||
include <abstractions/common/apt>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
@ -21,7 +21,7 @@ profile apt-helper @{exec_path} {
|
|||
|
||||
profile systemctl {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemctl>
|
||||
include <abstractions/app/systemctl>
|
||||
|
||||
capability net_admin,
|
||||
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/apt-mark
|
||||
profile apt-mark @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/apt-common>
|
||||
include <abstractions/common/apt>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ profile apt-show-versions @{exec_path} {
|
|||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/perl>
|
||||
include <abstractions/apt-common>
|
||||
include <abstractions/common/apt>
|
||||
|
||||
@{exec_path} r,
|
||||
@{bin}/perl r,
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ profile aptitude @{exec_path} flags=(complain) {
|
|||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/apt-common>
|
||||
include <abstractions/common/apt>
|
||||
|
||||
# To remove the following errors:
|
||||
# W: chmod 0700 of directory /var/lib/apt/lists/partial failed - SetupAPTPartialDirectory
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ include <tunables/global>
|
|||
@{exec_path} += @{lib}/command-not-found
|
||||
profile command-not-found @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/apt-common>
|
||||
include <abstractions/common/apt>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/python>
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@ include <tunables/global>
|
|||
profile debtags @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/apt-common>
|
||||
include <abstractions/common/apt>
|
||||
include <abstractions/python>
|
||||
|
||||
#capability sys_tty_config,
|
||||
|
|
|
|||
|
|
@ -78,7 +78,7 @@ profile dpkg @{exec_path} {
|
|||
|
||||
profile systemctl {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemctl>
|
||||
include <abstractions/app/systemctl>
|
||||
|
||||
include if exists <local/dpkg_systemctl>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -23,7 +23,9 @@ profile dpkg-preconfigure @{exec_path} {
|
|||
@{bin}/{,e}grep rix,
|
||||
@{bin}/locale rix,
|
||||
@{bin}/sed rix,
|
||||
@{bin}/sort rix,
|
||||
@{bin}/stty rix,
|
||||
@{bin}/tr rix,
|
||||
|
||||
@{bin}/dpkg rPx -> child-dpkg,
|
||||
@{bin}/apt-extracttemplates rPx,
|
||||
|
|
|
|||
|
|
@ -17,7 +17,7 @@ profile querybts @{exec_path} {
|
|||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/python>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/apt-common>
|
||||
include <abstractions/common/apt>
|
||||
|
||||
network inet dgram,
|
||||
network inet6 dgram,
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/reportbug
|
||||
profile reportbug @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/apt-common>
|
||||
include <abstractions/common/apt>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/dconf-write>
|
||||
include <abstractions/desktop>
|
||||
|
|
@ -109,7 +109,7 @@ profile reportbug @{exec_path} {
|
|||
|
||||
profile systemctl {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemctl>
|
||||
include <abstractions/app/systemctl>
|
||||
|
||||
include if exists <local/reportbug_systemctl>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -15,7 +15,7 @@ profile synaptic @{exec_path} {
|
|||
include <abstractions/fonts>
|
||||
include <abstractions/fontconfig-cache-read>
|
||||
include <abstractions/freedesktop.org>
|
||||
include <abstractions/apt-common>
|
||||
include <abstractions/common/apt>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
# To remove the following errors:
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/unattended-upgrade
|
||||
profile unattended-upgrade @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/apt-common>
|
||||
include <abstractions/common/apt>
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/bus/org.freedesktop.login1>
|
||||
include <abstractions/bus/org.freedesktop.NetworkManager>
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/update-apt-xapian-index
|
||||
profile update-apt-xapian-index @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/apt-common>
|
||||
include <abstractions/common/apt>
|
||||
include <abstractions/python>
|
||||
|
||||
@{exec_path} r,
|
||||
|
|
|
|||
|
|
@ -16,7 +16,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib_dirs}/@{name}
|
||||
profile brave @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/chromium>
|
||||
include <abstractions/app/chromium>
|
||||
|
||||
unix (send, receive) type=stream peer=(label=brave-crashpad-handler),
|
||||
|
||||
|
|
|
|||
|
|
@ -16,7 +16,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib_dirs}/@{name}
|
||||
profile chrome @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/chromium>
|
||||
include <abstractions/app/chromium>
|
||||
|
||||
@{exec_path} mrix,
|
||||
|
||||
|
|
|
|||
|
|
@ -16,7 +16,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib_dirs}/@{name}
|
||||
profile chromium @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/chromium>
|
||||
include <abstractions/app/chromium>
|
||||
|
||||
@{exec_path} mrix,
|
||||
|
||||
|
|
|
|||
|
|
@ -16,7 +16,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib_dirs}/@{name}
|
||||
profile opera @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/chromium>
|
||||
include <abstractions/app/chromium>
|
||||
|
||||
@{exec_path} mrix,
|
||||
|
||||
|
|
|
|||
|
|
@ -18,7 +18,7 @@ profile child-systemctl flags=(attach_disconnected) {
|
|||
include <abstractions/base>
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
include <abstractions/wutmp>
|
||||
|
||||
capability mknod,
|
||||
|
|
|
|||
|
|
@ -84,7 +84,7 @@ profile gdm-xsession @{exec_path} {
|
|||
|
||||
profile systemctl {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemctl>
|
||||
include <abstractions/app/systemctl>
|
||||
|
||||
owner /dev/tty@{int} rw,
|
||||
|
||||
|
|
|
|||
|
|
@ -8,7 +8,7 @@ include <tunables/global>
|
|||
|
||||
profile gnome-desktop-thumbnailers flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/bwrap>
|
||||
include <abstractions/common/bwrap>
|
||||
include <abstractions/gnome-strict>
|
||||
include <abstractions/gstreamer>
|
||||
|
||||
|
|
|
|||
|
|
@ -34,7 +34,7 @@ profile loupe @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
profile bwrap flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/bwrap>
|
||||
include <abstractions/common/bwrap>
|
||||
|
||||
signal (receive) set=(kill) peer=loupe,
|
||||
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
profile grub-sort-version @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/python>
|
||||
include if exists <abstractions/apt-common>
|
||||
include if exists <abstractions/common/apt>
|
||||
|
||||
capability dac_read_search,
|
||||
|
||||
|
|
|
|||
|
|
@ -154,7 +154,7 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
profile systemctl {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemctl>
|
||||
include <abstractions/app/systemctl>
|
||||
|
||||
include if exists <local/NetworkManager_systemctl>
|
||||
}
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = /opt/Mullvad*/mullvad-gui
|
||||
profile mullvad-gui @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/chromium-common>
|
||||
include <abstractions/common/chromium>
|
||||
include <abstractions/dconf-write>
|
||||
include <abstractions/dri-common>
|
||||
include <abstractions/dri-enumerate>
|
||||
|
|
|
|||
|
|
@ -34,7 +34,7 @@ profile netplan.script @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
profile udevadm {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
@{bin}/udevadm mr,
|
||||
|
||||
|
|
@ -49,7 +49,7 @@ profile netplan.script @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
profile systemctl {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemctl>
|
||||
include <abstractions/app/systemctl>
|
||||
|
||||
capability net_admin,
|
||||
|
||||
|
|
|
|||
|
|
@ -70,7 +70,7 @@ profile nm-dispatcher @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
profile systemctl {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemctl>
|
||||
include <abstractions/app/systemctl>
|
||||
|
||||
capability net_admin,
|
||||
|
||||
|
|
|
|||
|
|
@ -88,7 +88,7 @@ profile tailscaled @{exec_path} flags=(attach_disconnected) {
|
|||
|
||||
profile systemctl {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemctl>
|
||||
include <abstractions/app/systemctl>
|
||||
|
||||
capability mknod,
|
||||
capability net_admin,
|
||||
|
|
|
|||
|
|
@ -186,7 +186,7 @@ profile pacman @{exec_path} {
|
|||
|
||||
profile systemctl {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemctl>
|
||||
include <abstractions/app/systemctl>
|
||||
|
||||
capability net_admin,
|
||||
|
||||
|
|
|
|||
|
|
@ -40,7 +40,7 @@ profile pacman-hook-systemd @{exec_path} {
|
|||
|
||||
profile systemctl flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemctl>
|
||||
include <abstractions/app/systemctl>
|
||||
|
||||
capability net_admin,
|
||||
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@ profile bootctl @{exec_path} {
|
|||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/disks-read>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability mknod,
|
||||
capability net_admin,
|
||||
|
|
|
|||
|
|
@ -13,7 +13,7 @@ profile busctl @{exec_path} {
|
|||
include <abstractions/bus-system>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability net_admin,
|
||||
capability sys_ptrace,
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ profile journalctl @{exec_path} flags=(attach_disconnected) {
|
|||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability dac_override,
|
||||
capability dac_read_search,
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/localectl
|
||||
profile localectl @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability net_admin,
|
||||
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ profile loginctl @{exec_path} {
|
|||
include <abstractions/bus-system>
|
||||
include <abstractions/bus/org.freedesktop.login1.Session>
|
||||
include <abstractions/bus/org.freedesktop.login1>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability net_admin,
|
||||
capability sys_resource,
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ profile systemd-analyze @{exec_path} {
|
|||
include <abstractions/base>
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability sys_resource,
|
||||
capability net_admin,
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/systemd/systemd-backlight
|
||||
profile systemd-backlight @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability net_admin,
|
||||
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/systemd/systemd-binfmt
|
||||
profile systemd-binfmt @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability net_admin,
|
||||
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
profile systemd-cgtop @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@ include <tunables/global>
|
|||
profile systemd-coredump @{exec_path} flags=(attach_disconnected,mediate_deleted) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
# userns,
|
||||
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/systemd-cryptsetup @{lib}/systemd/systemd-cryptsetup
|
||||
profile systemd-cryptsetup @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
include <abstractions/disks-write>
|
||||
|
||||
capability ipc_lock,
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@ include <tunables/global>
|
|||
profile systemd-detect-virt @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability net_admin,
|
||||
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{bin}/systemd-escape
|
||||
profile systemd-escape @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ profile systemd-fsck @{exec_path} {
|
|||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/disks-read>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability net_admin,
|
||||
capability sys_resource,
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@ include <tunables/global>
|
|||
profile systemd-fsckd @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability net_admin,
|
||||
capability sys_tty_config,
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/systemd/system-generators/systemd-bless-boot-generator
|
||||
profile systemd-generator-bless-boot @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
profile systemd-generator-cryptsetup @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/systemd/system-generators/systemd-debug-generator
|
||||
profile systemd-generator-debug @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/systemd/system-generators/systemd-fstab-generator
|
||||
profile systemd-generator-fstab @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability dac_override,
|
||||
capability dac_read_search,
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
profile systemd-generator-getty @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
profile systemd-generator-gpt-auto @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/disks-read>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability sys_admin,
|
||||
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/systemd/system-generators/systemd-hibernate-resume-generator
|
||||
profile systemd-generator-hibernate-resume @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/systemd/system-generators/systemd-integritysetup-generator
|
||||
profile systemd-generator-integritysetup @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/systemd/system-generators/systemd-run-generator
|
||||
profile systemd-generator-run @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
ptrace (read) peer=@{systemd},
|
||||
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/systemd/system-generators/systemd-system-update-generator
|
||||
profile systemd-generator-system-update @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/systemd/user-generators/systemd-xdg-autostart-generator
|
||||
profile systemd-generator-user-autostart @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
capability net_admin,
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/systemd/user-environment-generators/*
|
||||
profile systemd-generator-user-environment @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
include <abstractions/nameservice-strict>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/systemd/system-generators/systemd-veritysetup-generator
|
||||
profile systemd-generator-veritysetup @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
ptrace (read) peer=@{systemd},
|
||||
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ profile systemd-homed @{exec_path} flags=(attach_disconnected) {
|
|||
include <abstractions/bus-system>
|
||||
include <abstractions/disks-write>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability chown,
|
||||
capability dac_override,
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
profile systemd-homework @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
@{exec_path} mr,
|
||||
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ profile systemd-hostnamed @{exec_path} flags=(attach_disconnected) {
|
|||
include <abstractions/base>
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/bus/org.freedesktop.PolicyKit1>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability sys_admin, # To set a hostname
|
||||
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@ include <tunables/global>
|
|||
profile systemd-journald @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability audit_control,
|
||||
capability audit_read,
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ profile systemd-localed @{exec_path} flags=(attach_disconnected) {
|
|||
include <abstractions/base>
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/consoles>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
# Needed?
|
||||
audit capability net_admin,
|
||||
|
|
|
|||
|
|
@ -16,7 +16,7 @@ profile systemd-logind @{exec_path} flags=(attach_disconnected) {
|
|||
include <abstractions/devices-usb>
|
||||
include <abstractions/disks-write>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability chown,
|
||||
capability dac_override,
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@ profile systemd-machined @{exec_path} {
|
|||
include <abstractions/base>
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability chown,
|
||||
capability dac_override,
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
profile systemd-makefs @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/disks-write>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability net_admin,
|
||||
capability sys_resource,
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/systemd/systemd-modules-load
|
||||
profile systemd-modules-load @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability net_admin,
|
||||
capability sys_module,
|
||||
|
|
|
|||
|
|
@ -12,7 +12,7 @@ profile systemd-networkd @{exec_path} flags=(attach_disconnected) {
|
|||
include <abstractions/base>
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/bus/org.freedesktop.hostname1>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability net_admin,
|
||||
capability net_bind_service,
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/systemd/systemd-networkd-wait-online
|
||||
profile systemd-networkd-wait-online @{exec_path} flags=(complain) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability net_admin,
|
||||
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
profile systemd-oomd @{exec_path} flags=(attach_disconnected) {
|
||||
include <abstractions/base>
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability dac_override,
|
||||
capability kill,
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/systemd/systemd-portabled
|
||||
profile systemd-portabled @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability chown,
|
||||
capability dac_override,
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/systemd/systemd-random-seed
|
||||
profile systemd-random-seed @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability net_admin,
|
||||
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
profile systemd-remount-fs @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability net_admin,
|
||||
capability sys_admin,
|
||||
|
|
|
|||
|
|
@ -14,7 +14,7 @@ profile systemd-resolved @{exec_path} flags=(attach_disconnected) {
|
|||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/p11-kit>
|
||||
include <abstractions/ssl_certs>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability net_bind_service,
|
||||
capability net_raw,
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/systemd/systemd-rfkill
|
||||
profile systemd-rfkill @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability net_admin,
|
||||
capability sys_ptrace,
|
||||
|
|
|
|||
|
|
@ -10,7 +10,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/systemd/systemd-shutdown
|
||||
profile systemd-shutdown @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability kill,
|
||||
capability sys_boot,
|
||||
|
|
|
|||
|
|
@ -11,7 +11,7 @@ profile systemd-sleep @{exec_path} {
|
|||
include <abstractions/base>
|
||||
include <abstractions/bus-system>
|
||||
include <abstractions/nameservice-strict>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability net_admin,
|
||||
capability sys_admin,
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/systemd/systemd-socket-proxyd
|
||||
profile systemd-socket-proxyd @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability net_admin,
|
||||
|
||||
|
|
|
|||
|
|
@ -9,7 +9,7 @@ include <tunables/global>
|
|||
@{exec_path} = @{lib}/systemd/systemd-sulogin-shell
|
||||
profile systemd-sulogin-shell @{exec_path} {
|
||||
include <abstractions/base>
|
||||
include <abstractions/systemd-common>
|
||||
include <abstractions/common/systemd>
|
||||
|
||||
capability net_admin,
|
||||
capability sys_resource,
|
||||
|
|
|
|||
Some files were not shown because too many files have changed in this diff Show more
Loading…
Reference in a new issue