mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2025-01-18 00:48:10 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Update profiles.

Browse source
This commit is contained in:
Alexandre Pujol 2021-12-08 17:38:43 +00:00
parent 4522ca91db
commit dc0347388b
Failed to generate hash of commit
14 changed files with 41 additions and 45 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
apparmor.d/groups/gnome/nautilus
View file

@ -18,8 +18,9 @@ profile nautilus @{exec_path} flags=(attach_disconnected) {
/{usr/,}bin/{,ba,da}sh rix,
/usr/share/nautilus/{,**} r,
/usr/share/tracker3/{,**} r,
/usr/share/poppler/{,**} r,
/usr/share/sounds/freedesktop/stereo/*.oga r,
/usr/share/tracker3/{,**} r,
owner @{user_share_dirs}/nautilus/{,**} rwk,

6
apparmor.d/groups/gnome/tracker-extract
View file

@ -44,10 +44,12 @@ profile tracker-extract @{exec_path} {
@{run}/udev/data/c235:* r,
@{run}/udev/data/c236:* r,
@{run}/udev/data/c51[0-9]:* r,
@{run}/udev/data/c50[0-9]:[0-9]* r,
@{run}/udev/data/c51[0-9]:[0-9]* r,
/dev/video[0-9]* rw,
/dev/dri/renderD128 rw,
/dev/media[0-9]* r,
/dev/video[0-9]* rw,
include if exists <local/tracker-extract>
}

1
apparmor.d/groups/pacman/pacman
View file

@ -74,7 +74,6 @@ profile pacman @{exec_path} {
/{usr/,}bin/update-ca-trust rPx,
/{usr/,}bin/update-desktop-database rPx,
/{usr/,}bin/update-mime-database rPx,
/{usr/,}lib/dkms/alpm-hook rPx,
/{usr/,}lib/systemd/systemd-* rPx,
/{usr/,}lib/vlc/vlc-cache-gen rPx,
/usr/share/libalpm/scripts/* rPx,

2
apparmor.d/groups/pacman/pacman-hook-dkms
View file

@ -6,7 +6,7 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}lib/dkms/alpm-hook
@{exec_path} = /usr/share/libalpm/scripts/dkms
profile pacman-hook-dkms @{exec_path} {
include <abstractions/base>

3
apparmor.d/groups/pacman/pacman-key
View file

@ -26,6 +26,7 @@ profile pacman-key @{exec_path} {
/{usr/,}bin/wc rix,
/usr/share/makepkg/{,**} r,
/usr/share/pacman/keyrings/* r,
/usr/share/terminfo/x/xterm-256color r,
/dev/tty rw,
@ -41,7 +42,7 @@ profile pacman-key @{exec_path} {
capability mknod,
/{usr/,}bin/gpg mr,
/{usr/,}bin/gpg-agent mr,
/{usr/,}bin/gpg-agent rix,
/usr/share/pacman/keyrings/* r,

2
apparmor.d/groups/systemd/systemd-logind
View file

@ -43,6 +43,8 @@ profile systemd-logind @{exec_path} flags=(complain) {
@{run}/udev/data/c116:[0-9]* r, # for ALSA
@{run}/udev/data/c226:[0-9]* r, # for /dev/dri/card*
@{run}/udev/data/c23[0-9]:[0-9]* r,
@{run}/udev/data/c50[0-9]:[0-9]* r,
@{run}/udev/data/c51[0-9]:[0-9]* r,
@{run}/udev/data/+input* r, # for mouse, keyboard, touchpad
@{run}/udev/data/+drm:card[0-9]-* r, # for screen outputs

1
apparmor.d/profiles-a-f/browserpass
View file

@ -37,6 +37,7 @@ profile browserpass @{exec_path} flags=(attach_disconnected) {
deny owner @{user_share_dirs}/gvfs-metadata/{,**} r,
deny owner @{HOME}/@{XDG_DOWNLOAD_DIR}/{,**} rw,
deny /dev/dri/card[0-9]* rw,
deny /dev/dri/renderD128 rw,
include if exists <local/browserpass>
}

6
apparmor.d/profiles-a-f/dkms
View file

@ -1,6 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# 2021 Alexandre Pujol <alexandre@pujol.io>
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -11,6 +11,7 @@ include <tunables/global>
profile dkms @{exec_path} flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/openssl>
capability dac_read_search,
capability mknod,
@ -63,8 +64,7 @@ profile dkms @{exec_path} flags=(attach_disconnected) {
/ r,
/{usr/,}lib/modules/*/updates/ rw,
/{usr/,}lib/modules/*/updates/dkms/ rw,
/{usr/,}lib/modules/*/updates/dkms/*.ko rw,
/{usr/,}lib/modules/*/updates/dkms/{,*,*/,**.ko.xz,**.ko.zst} rw,
/{usr/,}lib/modules/*/kernel/drivers/{,*,*/,**.ko.xz,**.ko.zst} rw,
/var/lib/dkms/ r,

7
apparmor.d/profiles-g-l/git
View file

@ -1,6 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2020-2021 Mikhail Morfikov
# 2021 Alexandre Pujol <alexandre@pujol.io>
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -77,7 +77,11 @@ profile git @{exec_path} {
/{usr/,}bin/vim rCx -> editor,
/{usr/,}bin/vim.* rCx -> editor,
/{usr/,}lib/code/extensions/git/dist/askpass.sh rPx,
/usr/share/aurpublish/*.hook rPx,
owner @{HOME}/.gitconfig r,
owner @{HOME}/.netrc r,
owner @{user_config_dirs}/git/{,*} rw,
/usr/share/git-core/{,**} r,
@ -106,7 +110,6 @@ profile git @{exec_path} {
/etc/mailname r,
profile gpg {
include <abstractions/base>
include <abstractions/consoles>

20
apparmor.d/profiles-g-l/hugo
View file

@ -1,13 +1,12 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2020-2021 Mikhail Morfikov
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{HUGO_DIR} = @{MOUNTS}/debuilder/hugo
@{exec_path} = /{usr/,}bin/hugo
profile hugo @{exec_path} {
include <abstractions/base>
@ -17,15 +16,12 @@ profile hugo @{exec_path} {
@{exec_path} mr,
# Hugo dirs
owner @{HOME}/hugo/ r,
owner @{HOME}/hugo/** r,
owner @{HOME}/hugo/**/public/ rw,
owner @{HOME}/hugo/**/public/** rw,
owner @{HUGO_DIR}/ r,
owner @{HUGO_DIR}/** r,
owner @{HUGO_DIR}/**/public/ rw,
owner @{HUGO_DIR}/**/public/** rw,
/usr/share/mime/{,**} r,
/etc/mime.types r,
owner @{HOME}/@{XDG_PROJECTS_DIR}/{,**} rw,
owner @{HOME}/@{XDG_PROJECTS_DIR}/**/.hugo_build.lock rwk,
owner /tmp/hugo_cache/ rw,
owner /tmp/hugo_cache/**/ rw,
@ -34,7 +30,5 @@ profile hugo @{exec_path} {
@{PROC}/sys/net/core/somaxconn r,
/etc/mime.types r,
include if exists <local/hugo>
}

11
apparmor.d/profiles-g-l/logrotate
View file

@ -12,15 +12,13 @@ profile logrotate @{exec_path} flags=(attach_disconnected, complain) {
include <abstractions/base>
include <abstractions/nameservice-strict>
# Needed for logfiles owned by other users than root, for instance exim.
capability dac_read_search,
capability dac_override,
capability chown,
capability dac_override,
capability dac_read_search,
capability fowner,
capability fsetid,
capability setgid,
capability setuid,
capability fsetid,
capability fowner,
# Needed?
audit deny capability net_admin,
@ -67,7 +65,6 @@ profile logrotate @{exec_path} flags=(attach_disconnected, complain) {
@{sys}/firmware/efi/efivars/SecureBoot-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]*-[0-9a-f]* r,
profile systemctl flags=(attach_disconnected, complain) {
include <abstractions/base>
include <abstractions/wutmp>

19
apparmor.d/profiles-s-z/umount
View file

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# Copyright (C) 2021 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -12,17 +13,11 @@ profile umount @{exec_path} flags=(complain) {
include <abstractions/consoles>
include <abstractions/nameservice-strict>
# To be able to umount anything
# umount2("/mnt", 0) = -1 EPERM (Operation not permitted)
#
# umount: /mnt: must be superuser to unmount.
capability sys_admin,
capability setuid,
capability setgid,
capability dac_read_search,
capability chown,
capability dac_read_search,
capability setgid,
capability setuid,
capability sys_admin,
umount,
@ -31,8 +26,8 @@ profile umount @{exec_path} flags=(complain) {
@{exec_path} mr,
/{usr/,}sbin/umount.* rPx,
/{usr/,}sbin/mount.* rPx,
/{usr/,}sbin/umount.* rPx,
/{usr/,}sbin/mount.* rPx,
# Mount points
@{HOME}/ r,

1
dists/ignore/ubuntu.ignore
View file

@ -1,3 +1,4 @@
aa-status
apparmor.d/groups/pacman
apparmor.systemd
root/usr/share/libalpm/hooks/apparmor.hook