mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-11-15 07:54:17 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

fix(profiles): ensure entry points for snap work.

Browse Source
This commit is contained in:
Alexandre Pujol 2023-09-05 13:59:37 +01:00
parent 2242fc3f47
commit e169ea5ccf
No known key found for this signature in database
GPG Key ID: C5469996F0DF68EC
6 changed files with 36 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
apparmor.d/profiles-s-z/snap
View File

@ -6,7 +6,10 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{bin}/snap /snap/snapd/@{int}@{bin}/snap
@{bin_dirs} = @{bin}/ /snap/snapd/@{int}@{bin}/
@{lib_dirs} = @{lib}/ /snap/snapd/@{int}@{lib}/
@{exec_path} = @{bin_dirs}/snap
profile snap @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
@ -43,9 +46,9 @@ profile snap @{exec_path} {
@{bin}/systemctl rPx -> child-systemctl,
/snap/{,**} rw,
/{snap/snapd/@{int}/,}{usr/,}lib/snapd/snap-confine rPx,
/{snap/snapd/@{int}/,}{usr/,}lib/snapd/snap-seccomp rPx,
/{snap/snapd/@{int}/,}{usr/,}lib/snapd/snapd r,
@{lib_dirs}/snapd/snap-confine rPx,
@{lib_dirs}/snapd/snap-seccomp rPx,
@{lib_dirs}/snapd/snapd rPx,
/etc/fstab r,

4
apparmor.d/profiles-s-z/snap-discard-ns
View File

@ -6,7 +6,9 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/snapd/snap-discard-ns /snap/snapd/@{int}@{lib}/snapd/snap-discard-ns
@{lib_dirs} = @{lib}/ /snap/snapd/@{int}@{lib}/
@{exec_path} = @{lib_dirs}/snapd/snap-discard-ns
profile snap-discard-ns @{exec_path} {
include <abstractions/base>

9
apparmor.d/profiles-s-z/snap-failure
View File

@ -6,14 +6,17 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/snapd/snap-failure /snap/snapd/@{int}@{lib}/snapd/snap-failure
@{lib_dirs} = @{lib}/ /snap/snapd/@{int}@{lib}/
@{exec_path} = @{lib_dirs}/snapd/snap-failure
profile snap-failure @{exec_path} {
include <abstractions/base>
@{exec_path} mr,
@{bin}/systemctl rCx -> child-systemctl,
/snap/snapd/@{int}@{lib}/snapd/snapd rPx,
@{bin}/systemctl rPx -> child-systemctl,
@{lib_dirs}/snapd/snapd rPx,
/var/lib/snapd/sequence/snapd.json r,

6
apparmor.d/profiles-s-z/snap-seccomp
View File

@ -6,7 +6,9 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/snapd/snap-seccomp /snap/snapd/@{int}@{lib}/snapd/snap-seccomp
@{lib_dirs} = @{lib}/ /snap/snapd/@{int}@{lib}/
@{exec_path} = @{lib_dirs}/snapd/snap-seccomp
profile snap-seccomp @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
@ -16,8 +18,6 @@ profile snap-seccomp @{exec_path} {
@{exec_path} mr,
/snap/snapd/@{int}/usr/lib/snapd/snap-seccomp r,
/var/lib/snapd/seccomp/bpf/{,**} rw,
@{sys}/kernel/mm/transparent_hugepage/hpage_pmd_size r,

4
apparmor.d/profiles-s-z/snap-update-ns
View File

@ -6,7 +6,9 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/snapd/snap-update-ns /snap/snapd/@{int}@{lib}/snapd/snap-update-ns
@{lib_dirs} = @{lib}/ /snap/snapd/@{int}@{lib}/
@{exec_path} = @{lib_dirs}/snapd/snap-update-ns
profile snap-update-ns @{exec_path} {
include <abstractions/base>

25
apparmor.d/profiles-s-z/snapd
View File

@ -6,7 +6,10 @@ abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{lib}/snapd/snapd /snap/snapd/@{int}@{lib}/snapd/snapd
@{bin_dirs} = @{bin}/ /snap/snapd/@{int}@{bin}/
@{lib_dirs} = @{lib}/ /snap/snapd/@{int}@{lib}/
@{exec_path} = @{lib_dirs}/snapd/snapd
profile snapd @{exec_path} {
include <abstractions/base>
include <abstractions/authentication>
@ -58,7 +61,7 @@ profile snapd @{exec_path} {
member=CheckAuthorization
peer=(name=org.freedesktop.PolicyKit1),
@{exec_path} mr,
@{exec_path} mrix,
@{bin}/adduser rPx,
@{bin}/cloud-init rPUx, # TODO: rPx ? limited to ubtuntu core, otherwise out of scope
@ -84,15 +87,15 @@ profile snapd @{exec_path} {
@{bin}/unsquashfs rix,
@{bin}/update-desktop-database rPx,
/{snap/snapd/@{int}/,}{usr/,}bin/fc-cache-* mr,
/{snap/snapd/@{int}/,}{usr/,}bin/snap rPx,
/{snap/snapd/@{int}/,}{usr/,}bin/xdelta3 rix, # TODO: rPx ?
/{snap/snapd/@{int}/,}{usr/,}lib/@{multiarch}/** mr,
/{snap/snapd/@{int}/,}{usr/,}lib/@{multiarch}/ld-*.so rix,
/{snap/snapd/@{int}/,}{usr/,}lib/snapd/snap-discard-ns rPx,
/{snap/snapd/@{int}/,}{usr/,}lib/snapd/snap-seccomp rPx,
/{snap/snapd/@{int}/,}{usr/,}lib/snapd/snap-update-ns rPx,
/{snap/snapd/@{int}/,}{usr/,}lib/snapd/snapd rix,
@{bin_dirs}/fc-cache-* mr,
@{bin_dirs}/snap rPx,
@{bin_dirs}/xdelta3 rix,
@{lib_dirs}/@{multiarch}/** mr,
@{lib_dirs}/@{multiarch}/ld-*.so rix,
@{lib_dirs}/snapd/apparmor_parser rPx -> apparmor_parser,
@{lib_dirs}/snapd/snap-discard-ns rPx,
@{lib_dirs}/snapd/snap-seccomp rPx,
@{lib_dirs}/snapd/snap-update-ns rPx,
/usr/share/bash-completion/{,**} r,
/usr/share/dbus-1/{system,session}.d/{,snapd*} r,