mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-18 08:58:15 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Initial support for zsys

Browse source
This commit is contained in:
Jeroen Rijken 2022-07-30 11:32:42 +02:00 committed by Alex
parent 33ff1abc35
commit d083e927a4
11 changed files with 88 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
apparmor.d/groups/apt/apt
View file

@ -88,6 +88,7 @@ profile apt @{exec_path} flags=(attach_disconnected) {
/{usr/,}bin/snap rPUx,
/{usr/,}lib/cnf-update-db rPx,
/{usr/,}lib/needrestart/apt-pinvoke rPx,
@{libexec}/zsys-system-autosnapshot rPx,
# For building the source after the download process is finished (apt-get source --compile)
/{usr/,}bin/dpkg-buildpackage rPUx,

2
apparmor.d/groups/apt/apt-listbugs-aptcleanup
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /usr/libexec/apt-listbugs/aptcleanup
@{exec_path} = @{libexec}/apt-listbugs/aptcleanup
profile apt-listbugs-aptcleanup @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>

2
apparmor.d/groups/apt/apt-listbugs-migratepins
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /usr/libexec/apt-listbugs/migratepins
@{exec_path} = @{libexec}/apt-listbugs/migratepins
profile apt-listbugs-migratepins @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>

5
apparmor.d/groups/apt/unattended-upgrade
View file

@ -49,7 +49,7 @@ profile unattended-upgrade @{exec_path} flags=(attach_disconnected) {
dbus receive bus=system path=/org/freedesktop/NetworkManager
interface=org.freedesktop.NetworkManager
member=StateChanged,
member={CheckPermissions,StateChanged},
@{exec_path} mr,
@ -74,11 +74,14 @@ profile unattended-upgrade @{exec_path} flags=(attach_disconnected) {
/{usr/,}lib/apt/methods/http{,s} rPx,
/{usr/,}lib/needrestart/apt-pinvoke rPx,
/{usr/,}lib/update-notifier/update-motd-updates-available rPx,
@{libexec}/zsys-system-autosnapshot rPx,
/usr/share/distro-info/* r,
/etc/apt/*.list r,
/etc/apt/apt.conf.d/{,**} r,
/etc/update-manager/{,**} r,
/etc/update-motd.d/{91-release-upgrade,92-unattended-upgrades} r,
/etc/machine-id r,

1
apparmor.d/groups/ubuntu/do-release-upgrade
View file

@ -35,6 +35,7 @@ profile do-release-upgrade @{exec_path} {
/etc/machine-id r,
/etc/update-manager/{,**} r,
/var/lib/ubuntu-release-upgrader/release-upgrade-available rw,
/var/lib/update-manager/* rw,
/var/cache/apt/pkgcache.bin{,.*} rw,

2
apparmor.d/groups/ubuntu/release-upgrade-motd
View file

@ -15,11 +15,13 @@ profile release-upgrade-motd @{exec_path} {
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/date rix,
/{usr/,}bin/expr rix,
/{usr/,}bin/id rix,
/{usr/,}bin/stat rix,
/{usr/,}bin/do-release-upgrade rPx,
/var/lib/ubuntu-release-upgrader/release-upgrade-available rw,
@{PROC}/filesystems r,
include if exists <local/release-upgrade-motd>
}

2
apparmor.d/profiles-m-r/mount-zfs
View file

@ -25,7 +25,7 @@ profile mount-zfs @{exec_path} flags=(complain) {
mount fstype=zfs -> @{MOUNTS}/,
mount fstype=zfs -> @{MOUNTS}/*/,
mount fstype=zfs -> /,
mount fstype=zfs -> /*/,
mount fstype=zfs -> /**/,
mount fstype=zfs -> /tmp/zfsmnt.*/,
mount fstype=zfs -> /tmp/zfsmnt.*/*/,

1
apparmor.d/profiles-s-z/sudo
View file

@ -37,6 +37,7 @@ profile sudo @{exec_path} {
signal (send) peer=unconfined,
signal (send) set=(cont,hup) peer=su,
signal (send) set=winch peer=apt,
dbus send bus=system path=/org/freedesktop/login[0-9]
interface=org.freedesktop.login[0-9].Manager

4
apparmor.d/profiles-s-z/zpool
View file

@ -22,7 +22,7 @@ profile zpool @{exec_path} {
/etc/zfs/*.cache rwk,
@{run}/blkid/blkid.tab rw,
@{run}/blkid/blkid.tab.old l,
@{run}/blkid/blkid.tab.old rwl,
@{run}/blkid/blkid.tab-* rwl,
@{sys}/bus/pci/slots/ r,
@ -34,5 +34,5 @@ profile zpool @{exec_path} {
/dev/pts/[0-9]* rw,
/dev/zfs rw,
include if exists <local/zfs>
include if exists <local/zpool>
}

34
apparmor.d/profiles-s-z/zsys-system-autosnapshot Normal file
View file

@ -0,0 +1,34 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2022 Jeroen Rijken
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}{s,}bin/zsys-system-autosnapshot
profile zsys-system-autosnapshot flags=(complain) @{exec_path} {
include <abstractions/base>
@{exec_path} rm,
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/cat rix,
/{usr/,}bin/cp rix,
/{usr/,}bin/rm rix,
/{usr/,}bin/zsysctl rix,
/{usr/,}bin/zsysd rix,
/{usr/,}lib/locale/locale-archive r,
/var/log/unattended-upgrades/unattended-upgrades-dpkg.log rw,
@{run}/zsys-bootmenu.unattended-upgrades rw,
@{run}/zsys-snapshot.unattended-upgrades rw,
@{run}/unattended-upgrades.pid r,
@{PROC}/filesystems r,
/dev/pts/[0-9]* rw,
include if exists <local/zsys-system-autosnapshot>
}

40
apparmor.d/profiles-s-z/zsysd Normal file
View file

@ -0,0 +1,40 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2022 Jeroen Rijken
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}{s,}bin/zsysd /{usr/,}{s,}bin/zsysctl
profile zsysctl @{exec_path} flags=(complain) {
include <abstractions/base>
include <abstractions/dbus-strict>
@{exec_path} rm,
/{usr/,}bin/zsysctl rix,
/{usr/,}bin/zsysd rix,
/etc/hostid r,
/etc/passwd r,
/etc/nsswitch.conf r,
/etc/zsys.conf r,
/var/log/unattended-upgrades/unattended-upgrades-dpkg.log rw,
@{run}/systemd/notify rw,
@{run}/unattended-upgrades.pid r,
@{run}/zsys-snapshot.unattended-upgrades rw,
@{run}/zsysd.sock rw,
@{PROC}/@{pids}/mounts r,
@{PROC}/filesystems r,
@{PROC}/sys/kernel/spl/hostid r,
@{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r,
/dev/pts/[0-9]* rw,
/dev/zfs rw,
include if exists <local/zsysctl>
}