mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-30 06:45:10 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

feat(profiles): add landscape-sysinfo profiles.

Browse source
This commit is contained in:
Alexandre Pujol 2023-03-10 10:25:18 +00:00
parent 0d6e3deb24
commit c4e607ebfe
Failed to generate hash of commit
2 changed files with 81 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

47
apparmor.d/profiles-g-l/landscape-sysinfo Normal file
View file

@ -0,0 +1,47 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/landscape-sysinfo
profile landscape-sysinfo @{exec_path} {
include <abstractions/base>
include <abstractions/nameservice-strict>
include <abstractions/openssl>
include <abstractions/python>
capability dac_override,
capability kill,
capability sys_ptrace,
network inet dgram,
network inet6 dgram,
network netlink raw,
ptrace (read),
@{exec_path} mr,
/{usr/,}bin/who rix,
/var/log/landscape/{,**} rw,
@{run}/utmp rwk,
@{sys}/class/thermal/ r,
@{PROC}/ r,
@{PROC}/@{pids}/cmdline r,
@{PROC}/@{pids}/stat r,
@{PROC}/@{pids}/status r,
@{PROC}/uptime r,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/mounts r,
/dev/tty[0-9]* rw,
include if exists <local/landscape-sysinfo>
}

34
apparmor.d/profiles-g-l/landscape-sysinfo.wrapper Normal file
View file

@ -0,0 +1,34 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /usr/share/landscape/landscape-sysinfo.wrapper
profile landscape-sysinfo.wrapper @{exec_path} {
include <abstractions/base>
@{exec_path} mr,
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/bc rix,
/{usr/,}bin/cat rix,
/{usr/,}bin/cut rix,
/{usr/,}bin/date rix,
/{usr/,}bin/find rix,
/{usr/,}bin/grep rix,
/{usr/,}bin/landscape-sysinfo rPx,
/ r,
/etc/default/locale r,
/var/lib/landscape/landscape-sysinfo.cache rw,
@{PROC}/loadavg r,
/dev/tty[0-9]* rw,
include if exists <local/landscape-sysinfo.wrapper>
}