mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-11-15 07:54:17 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

refractor(profiles): improve child profile structure.

Browse Source
This commit is contained in:
Alexandre Pujol 2023-11-09 17:29:34 +00:00
parent b49eb4c416
commit ee658c41a6
No known key found for this signature in database
GPG Key ID: C5469996F0DF68EC
5 changed files with 13 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
apparmor.d/groups/children/child-dpkg
View File

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# Copyright (C) 2021-2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
# Note: This profile does not specify an attachment path because it is
@ -12,7 +13,7 @@ abi <abi/3.0>,
include <tunables/global>
# Do not attach to @{bin}/dpkg by default
@{exec_path} = @{bin}/dpkg
profile child-dpkg {
include <abstractions/base>
include <abstractions/consoles>
@ -21,7 +22,7 @@ profile child-dpkg {
capability dac_read_search,
capability setgid,
@{bin}/dpkg mr,
@{exec_path} mr,
# Do not strip env to avoid errors like the following:
# ERROR: ld.so: object 'libfakeroot-sysv.so' from LD_PRELOAD cannot be preloaded (cannot open

5
apparmor.d/groups/children/child-dpkg-divert
View File

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# Copyright (C) 2021-2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only
# Note: This profile does not specify an attachment path because it is
@ -12,11 +13,11 @@ abi <abi/3.0>,
include <tunables/global>
# Do not attach to @{bin}/dpkg-divert by default
@{exec_path} = @{bin}/dpkg-divert
profile child-dpkg-divert {
include <abstractions/base>
@{bin}/dpkg-divert mr,
@{exec_path} mr,
/var/lib/dpkg/arch r,
/var/lib/dpkg/status r,

8
apparmor.d/groups/children/child-open
View File

@ -16,7 +16,8 @@ abi <abi/3.0>,
include <tunables/global>
# App allowed to open
@{exec_path} = @{bin}/exo-open @{bin}/xdg-open
@{exec_path} += @{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop @{lib}/gio-launch-desktop
profile child-open {
include <abstractions/base>
include <abstractions/dri-enumerate>
@ -24,10 +25,7 @@ profile child-open {
include <abstractions/vulkan>
include <abstractions/xdg-open>
@{bin}/exo-open mr,
@{bin}/xdg-open mr,
@{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop mrix,
@{lib}/gio-launch-desktop mrix,
@{exec_path} mrix,
@{bin}/{,ba,da}sh rix,
@{bin}/{,m,g}awk rix,

6
apparmor.d/groups/children/child-pager
View File

@ -13,7 +13,7 @@ abi <abi/3.0>,
include <tunables/global>
# Do not attach to @{bin}/pager by default
@{exec_path} = @{bin}/pager @{bin}/less @{bin}/more
profile child-pager {
include <abstractions/base>
include <abstractions/consoles>
@ -24,9 +24,7 @@ profile child-pager {
signal (receive) set=(stop, cont, term, kill),
@{bin}/ r,
@{bin}/pager mr,
@{bin}/less mr,
@{bin}/more mr,
@{exec_path} mr,
@{system_share_dirs}/terminfo/{,**} r,

4
apparmor.d/groups/children/child-systemctl
View File

@ -13,7 +13,7 @@ abi <abi/3.0>,
include <tunables/global>
# Do not attach to @{bin}/systemctl by default
@{exec_path} = @{bin}/systemctl
profile child-systemctl flags=(attach_disconnected) {
include <abstractions/base>
include <abstractions/consoles>
@ -33,7 +33,7 @@ profile child-systemctl flags=(attach_disconnected) {
interface=org.freedesktop.systemd[0-9].Manager
member=GetUnitFileState,
@{bin}/systemctl mr,
@{exec_path} mr,
/etc/machine-id r,
/etc/systemd/user/{,**} rwl,