mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-11-15 07:54:17 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat(profile): general update

Browse Source
This commit is contained in:
Alexandre Pujol 2023-09-29 19:25:30 +01:00
parent 6f2ae26749
commit c8ee832c11
No known key found for this signature in database
GPG Key ID: C5469996F0DF68EC
23 changed files with 66 additions and 35 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
apparmor.d/groups/apps/dropbox
View File

@ -108,7 +108,7 @@ profile dropbox @{exec_path} {
owner /tmp/dropbox-antifreeze-* rw,
owner /tmp/[a-zA-z0-9]* rw,
owner /tmp/#@{int} rw,
owner /var/tmp/etilqs_* rw,
owner /var/tmp/etilqs_@{hex} rw,
@{run}/systemd/users/@{uid} r,

3
apparmor.d/groups/children/child-open
View File

@ -67,6 +67,7 @@ profile child-open {
@{bin}/discord{,-ptb} rPx,
@{bin}/draw.io rPUx,
@{bin}/dropbox rPx,
@{bin}/element-desktop rPx,
@{bin}/engrampa rPx,
@{bin}/eog rPUx,
@{bin}/evince rPx,
@ -74,6 +75,7 @@ profile child-open {
@{bin}/filezilla rPx,
@{bin}/flameshot rPx,
@{bin}/geany rPx,
@{bin}/gimp* rPUx,
@{bin}/gnome-calculator rPUx,
@{bin}/gnome-disk-image-mounter rPx,
@{bin}/gnome-disks rPx,
@ -84,6 +86,7 @@ profile child-open {
@{bin}/qpdfview rPx,
@{bin}/smplayer rPx,
@{bin}/spacefm rPx,
@{bin}/steam-runtime rPUx,
@{bin}/teams rPUx,
@{bin}/telegram-desktop rPx,
@{bin}/thunderbird rPx,

2
apparmor.d/groups/gnome/evolution-alarm-notify
View File

@ -28,5 +28,7 @@ profile evolution-alarm-notify @{exec_path} {
/usr/share/glib-2.0/schemas/gschemas.compiled r,
/usr/share/*ubuntu/applications/ r,
/etc/timezone r,
include if exists <local/evolution-alarm-notify>
}

6
apparmor.d/groups/gnome/gnome-system-monitor
View File

@ -46,9 +46,9 @@ profile gnome-system-monitor @{exec_path} flags=(attach_disconnected) {
@{run}/systemd/sessions/* r,
@{run}/systemd/sessions/*.ref r,
@{sys}/devices/@{pci}/{,*/}net/*/statistics/collisions r,
@{sys}/devices/@{pci}/{,*/}net/*/statistics/rx_{bytes,errors,packets} r,
@{sys}/devices/@{pci}/{,*/}net/*/statistics/tx_{bytes,errors,packets} r,
@{sys}/devices/@{pci}/net/*/statistics/collisions r,
@{sys}/devices/@{pci}/net/*/statistics/rx_{bytes,errors,packets} r,
@{sys}/devices/@{pci}/net/*/statistics/tx_{bytes,errors,packets} r,
@{sys}/devices/@{pci}/usb@{int}/**/net/*/statistics/collisions r,
@{sys}/devices/@{pci}/usb@{int}/**/net/*/statistics/rx_{bytes,errors,packets} r,
@{sys}/devices/@{pci}/usb@{int}/**/net/*/statistics/tx_{bytes,errors,packets} r,

3
apparmor.d/groups/systemd/systemd-udevd
View File

@ -38,11 +38,14 @@ profile systemd-udevd @{exec_path} flags=(attach_disconnected,complain) {
@{bin}/{,ba,da}sh rix,
@{bin}/{,e}grep rix,
@{bin}/*-print-pci-ids rix,
@{bin}/alsactl rPUx,
@{bin}/cat rix,
@{bin}/chgrp rix,
@{bin}/chmod rix,
@{bin}/cut rix,
@{bin}/dmsetup rPUx,
@{bin}/ethtool rix,
@{bin}/kmod rPx,
@{bin}/ln rix,
@{bin}/logger rix,
@{bin}/lvm rPx,

7
apparmor.d/groups/virt/cockpit-bridge
View File

@ -18,6 +18,7 @@ profile cockpit-bridge @{exec_path} {
capability dac_read_search,
capability net_admin,
capability sys_nice,
capability sys_ptrace,
network inet dgram,
network inet stream,
@ -55,9 +56,12 @@ profile cockpit-bridge @{exec_path} {
@{run}/user/@{uid}/ssh-agent.[0-9A-Z]* rw,
@{run}/utmp r,
@{sys}/class/hwmon/ r,
@{sys}/devices/**/hwmon@{int}/ r,
@{sys}/devices/**/hwmon@{int}/{name,temp*} r,
@{sys}/fs/cgroup/*.slice/**/memory* r,
@{sys}/fs/cgroup/**/ r,
@{sys}/fs/cgroup/**/cpu.{stat,weight} r,
@{sys}/fs/cgroup/**/memory* r,
@{PROC}/ r,
@{PROC}/@{pids}/cgroup r,
@ -68,6 +72,7 @@ profile cockpit-bridge @{exec_path} {
@{PROC}/diskstats r,
@{PROC}/loadavg r,
@{PROC}/uptime r,
owner @{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/mounts r,

3
apparmor.d/groups/virt/cockpit-session
View File

@ -29,10 +29,11 @@ profile cockpit-session @{exec_path} flags=(attach_disconnected) {
@{lib}/cockpit/cockpit-pcp rPx,
@{etc_ro}/environment r,
@{etc_ro}/security/limits.d/{,*.conf} r,
/etc/cockpit/disallowed-users r,
/etc/group r,
/etc/motd r,
/etc/motd.d/ r,
@{etc_ro}/security/limits.d/{,*.conf} r,
/etc/shells r,
@{run}/faillock/[a-zA-z0-9]* rwk,

2
apparmor.d/profiles-a-f/agetty
View File

@ -23,8 +23,6 @@ profile agetty @{exec_path} {
@{bin}/login rPx,
/usr/share/subiquity/console-conf-wrapper rPx, # only:core22
@{etc_rw}/issue r,
/{,usr/}lib/os-release r,
/{etc,run,lib,usr/lib}/issue r,

1
apparmor.d/profiles-a-f/dkms
View File

@ -63,6 +63,7 @@ profile dkms @{exec_path} flags=(attach_disconnected) {
@{lib}/modules/*/build/scripts/** rix,
@{lib}/modules/*/build/tools/objtool/objtool rix,
/var/lib/dkms/**/build/* rix,
/var/lib/dkms/**/configure rix,
/var/lib/dkms/**/dkms.postbuild rix,

16
apparmor.d/profiles-a-f/file-roller
View File

@ -14,8 +14,12 @@ profile file-roller @{exec_path} {
include <abstractions/dconf-write>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/gtk>
include <abstractions/nameservice-strict>
include <abstractions/user-download-strict>
include <abstractions/user-write>
include <abstractions/wayland>
include <abstractions/X-strict>
dbus bind bus=session name=org.gnome.ArchiveManager1,
@ -25,16 +29,16 @@ profile file-roller @{exec_path} {
# Archivers
@{bin}/7z rix,
@{lib}/p7zip/7z rix,
@{bin}/unrar-nonfree rix,
@{bin}/zip rix,
@{bin}/unzip rix,
@{bin}/tar rix,
@{bin}/xz rix,
@{bin}/bzip2 rix,
@{bin}/cpio rix,
@{bin}/gzip rix,
@{bin}/tar rix,
@{bin}/unrar-nonfree rix,
@{bin}/unzip rix,
@{bin}/xz rix,
@{bin}/zip rix,
@{bin}/zstd rix,
@{lib}/p7zip/7z rix,
/usr/share/themes/{,**} r,
/usr/share/X11/xkb/{,**} r,

2
apparmor.d/profiles-g-l/hw-probe
View File

@ -191,6 +191,7 @@ profile hw-probe @{exec_path} {
@{sys}/devices/**/uevent r,
@{run}/udev/data/* r,
include if exists <local/hw-probe_udevadm>
}
profile kmod {
@ -205,6 +206,7 @@ profile hw-probe @{exec_path} {
@{sys}/module/*/{coresize,refcnt} r,
@{sys}/module/*/holders/ r,
include if exists <local/hw-probe_kmod>
}
profile netconfig {

4
apparmor.d/profiles-g-l/logrotate
View File

@ -17,11 +17,9 @@ profile logrotate @{exec_path} flags=(attach_disconnected) {
capability dac_read_search,
capability fowner,
capability fsetid,
capability net_admin,
capability setgid,
capability setuid,
capability net_admin,
audit deny capability net_admin,
signal (send) set=(hup),
signal (send) set=(term cont) peer=systemd-tty-ask-password-agent,

18
apparmor.d/profiles-g-l/lscpu
View File

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# Copyright (C) 2021-2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -13,22 +14,19 @@ profile lscpu @{exec_path} {
@{exec_path} mr,
@{PROC}/ r,
@{PROC}/sys/kernel/osrelease r,
@{PROC}/bus/pci/devices r,
@{sys}/devices/system/cpu/{,**} r,
@{sys}/firmware/dmi/tables/DMI r,
@{sys}/devices/system/node/ r,
@{sys}/devices/system/node/node@{int}/cpumap r,
@{sys}/firmware/dmi/tables/DMI r,
@{sys}/kernel/cpu_byteorder r,
owner @{sys}/kernel/cpu_byteorder r,
@{PROC}/ r,
@{PROC}/bus/pci/devices r,
@{PROC}/sys/kernel/osrelease r,
/dev/tty@{int} rw,
deny network unix stream,
include if exists <local/lscpu>
}

2
apparmor.d/profiles-m-r/quiterss
View File

@ -67,7 +67,7 @@ profile quiterss @{exec_path} {
owner /tmp/qtsingleapp-quiter-[0-9]*-[0-9]* rw,
owner /tmp/qtsingleapp-quiter-[0-9]*-[0-9]*-lockfile rwk,
owner /var/tmp/etilqs_* rw,
owner /var/tmp/etilqs_@{hex} rw,
# Allowed apps to open
@{lib}/firefox/firefox rPUx,

7
apparmor.d/profiles-m-r/run-parts
View File

@ -129,6 +129,12 @@ profile run-parts @{exec_path} {
/etc/kernel/prerm.d/ r,
/etc/kernel/prerm.d/dkms rCx -> kernel,
/usr/share/finalrd/ r,
/usr/share/finalrd/mdadm.finalrd rPUx,
/usr/share/finalrd/open-iscsi.finalrd rPUx,
/usr/share/landscape/landscape-sysinfo.wrapper rPUx,
owner /tmp/#@{int} rw,
owner /tmp/$anacron* rw,
owner /tmp/file@{rand6} ra,
@ -203,6 +209,7 @@ profile run-parts @{exec_path} {
@{bin}/dkms rPx,
@{bin}/dpkg rPx -> child-dpkg,
@{bin}/systemd-detect-virt rPx,
@{bin}/update-alternatives rPx,
@{bin}/update-grub rPUx,
@{bin}/update-initramfs rPx,
@{lib}/dkms/dkms_autoinstaller rPx,

4
apparmor.d/profiles-s-z/snap
View File

@ -51,8 +51,8 @@ profile snap @{exec_path} {
/snap/{,**} rw,
# @{lib_dirs}/snap-confine rPx -> /usr/lib/snapd/snap-confine,
@{lib_dirs}/snapd/snap-seccomp rPx -> snap-seccomp,
@{lib_dirs}/snapd/snapd rPx -> snapd,
@{lib_dirs}/snapd/snap-seccomp rPx,
@{lib_dirs}/snapd/snapd rPx,
/etc/fstab r,

2
apparmor.d/profiles-s-z/snap-failure
View File

@ -15,7 +15,7 @@ profile snap-failure @{exec_path} {
@{exec_path} mr,
@{bin}/systemctl rPx -> child-systemctl,
@{lib_dirs}/snapd/snapd rPx -> snapd,
@{lib_dirs}/snapd/snapd rPx,
/var/lib/snapd/sequence/snapd.json r,

6
apparmor.d/profiles-s-z/snapd
View File

@ -92,9 +92,9 @@ profile snapd @{exec_path} {
@{lib_dirs}/@{multiarch}/** mr,
@{lib_dirs}/@{multiarch}/ld-*.so rix,
@{lib_dirs}/snapd/apparmor_parser rPx -> apparmor_parser,
@{lib_dirs}/snapd/snap-discard-ns rPx -> snap-discard-ns,
@{lib_dirs}/snapd/snap-seccomp rPx -> snap-seccomp,
@{lib_dirs}/snapd/snap-update-ns rPx -> snap-update-ns,
@{lib_dirs}/snapd/snap-discard-ns rPx,
@{lib_dirs}/snapd/snap-seccomp rPx,
@{lib_dirs}/snapd/snap-update-ns rPx,
/usr/share/bash-completion/{,**} r,
/usr/share/dbus-1/{system,session}.d/{,snapd*} r,

1
apparmor.d/profiles-s-z/spotify
View File

@ -82,6 +82,7 @@ profile spotify @{exec_path} {
owner @{PROC}/@{pid}/task/@{tid}/stat r,
owner @{PROC}/@{pid}/task/@{tid}/status r,
/dev/tty rw,
owner /dev/shm/pulse-shm-@{int} r,
deny @{user_share_dirs}/gvfs-metadata/* r,

1
apparmor.d/profiles-s-z/sudo
View File

@ -56,6 +56,7 @@ profile sudo @{exec_path} {
@{lib}/** rPUx,
@{lib}/sudo/** mr,
/opt/*/** rPUx,
/snap/snapd/@{int}@{bin}/snap rPUx,
@{etc_ro}/environment r,

1
apparmor.d/profiles-s-z/transmission-gtk
View File

@ -50,6 +50,7 @@ profile transmission-gtk @{exec_path} {
@{run}/mount/utab r,
@{PROC}/@{pid}/net/route r,
@{PROC}/sys/net/ipv6/conf/all/disable_ipv6 r,
owner @{PROC}/@{pid}/cmdline r,
owner @{PROC}/@{pid}/comm r,
owner @{PROC}/@{pid}/mountinfo r,

7
apparmor.d/profiles-s-z/udisksd
View File

@ -136,12 +136,17 @@ profile udisksd @{exec_path} flags=(attach_disconnected) {
@{run}/cryptsetup/L* rwk,
@{sys}/bus/ r,
@{sys}/bus/pci/slots/ r,
@{sys}/class/ r,
@{sys}/devices/pci[0-9]*/**/{ata,usb,mmc}[0-9]/{,**/}remove rw,
@{sys}/class/nvme-subsystem/ r,
@{sys}/class/nvme/ r,
@{sys}/devices/pci[0-9]*/**/{ata,usb,mmc,virtio}[0-9]/{,**/}uevent w,
@{sys}/devices/pci[0-9]*/**/{ata,usb,mmc}[0-9]/{,**/}remove rw,
@{sys}/devices/virtual/bdi/**/read_ahead_kb r,
@{sys}/devices/virtual/block/*/{,**} rw,
@{sys}/devices/virtual/block/loop[0-9]*/uevent rw,
@{sys}/devices/virtual/dmi/id/product_uuid r,
@{sys}/devices/virtual/nvme-subsystem/{,**} r,
@{sys}/fs/ r,
@{PROC}/cmdline r,

1
apparmor.d/profiles-s-z/update-cracklib
View File

@ -22,6 +22,7 @@ profile update-cracklib @{exec_path} {
@{bin}/grep rix,
@{bin}/gzip rix,
@{bin}/install rix,
@{bin}/install rix,
@{bin}/sort rix,
@{bin}/tr rix,