mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-11-15 07:54:17 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat(profiles): update apt related profiles.

Browse Source
This commit is contained in:
Alexandre Pujol 2023-11-19 21:40:12 +00:00
parent 07e7810d15
commit e29e839c62
No known key found for this signature in database
GPG Key ID: C5469996F0DF68EC
2 changed files with 21 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
apparmor.d/groups/apt/apt-methods-file
View File

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# Copyright (C) 2021-2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
@ -19,37 +20,37 @@ profile apt-methods-file @{exec_path} {
capability setgid,
capability setuid,
signal (receive) peer=apt,
signal (receive) peer=apt-get,
signal (receive) peer=apt,
signal (receive) peer=aptitude,
signal (receive) peer=packagekitd,
signal (receive) peer=synaptic,
@{exec_path} mr,
# apt-helper gets "no new privs" so "rix" it
@{lib}/apt/apt-helper rix,
/etc/apt/apt.conf.d/{,*} r,
/etc/apt/apt.conf r,
/etc/apt/mirrors/* r,
/usr/share/dpkg/cputable r,
/usr/share/dpkg/tupletable r,
# For shell pwd
/ r,
/etc/ r,
/root/ r,
/etc/apt/apt.conf.d/{,*} r,
/etc/apt/apt.conf r,
/usr/share/dpkg/cputable r,
/usr/share/dpkg/tupletable r,
/var/lib/apt/lists/{,**} r,
owner /var/lib/apt/lists/* rw,
/var/lib/apt/lists/{,**} rw,
owner /var/lib/apt/lists/partial/* rw,
/var/log/cron-apt/temp w,
# For package building
@{user_build_dirs}/** rwkl -> @{user_build_dirs}/**,
# file_inherit
owner /dev/tty@{int} rw,
/var/log/cron-apt/temp w,
include if exists <local/apt-methods-file>
}

13
apparmor.d/groups/apt/apt-methods-mirror
View File

@ -20,26 +20,29 @@ profile apt-methods-mirror @{exec_path} {
capability setgid,
capability setuid,
signal (receive) peer=apt,
signal (receive) peer=apt-get,
signal (receive) peer=apt,
signal (receive) peer=aptitude,
signal (receive) peer=packagekitd,
signal (receive) peer=synaptic,
@{exec_path} mr,
/var/lib/apt/lists/{,**} r,
owner /var/lib/apt/lists/* rw,
owner /var/lib/apt/lists/partial/* rw,
/etc/apt/mirrors/* r,
# For shell pwd
/ r,
/etc/ r,
/root/ r,
/var/lib/apt/lists/{,**} r,
owner /var/lib/apt/lists/* rw,
owner /var/lib/apt/lists/partial/* rw,
# For package building
@{user_build_dirs}/** rwkl -> @{user_build_dirs}/**,
# file_inherit
owner /dev/tty@{int} rw,
include if exists <local/apt-methods-mirror>