mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-11-15 07:54:17 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

refractor(profiles): improve child profile structure.

Browse Source
This commit is contained in:
Alexandre Pujol 2023-11-09 17:29:34 +00:00
parent b49eb4c416
commit ee658c41a6
No known key found for this signature in database
GPG Key ID: C5469996F0DF68EC
5 changed files with 13 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
apparmor.d/groups/children/child-dpkg
View File

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov # Copyright (C) 2019-2021 Mikhail Morfikov
# Copyright (C) 2021-2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
# Note: This profile does not specify an attachment path because it is # Note: This profile does not specify an attachment path because it is
@ -12,7 +13,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
# Do not attach to @{bin}/dpkg by default @{exec_path} = @{bin}/dpkg
profile child-dpkg { profile child-dpkg {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>
@ -21,7 +22,7 @@ profile child-dpkg {
capability dac_read_search, capability dac_read_search,
capability setgid, capability setgid,
@{bin}/dpkg mr, @{exec_path} mr,
# Do not strip env to avoid errors like the following: # Do not strip env to avoid errors like the following:
# ERROR: ld.so: object 'libfakeroot-sysv.so' from LD_PRELOAD cannot be preloaded (cannot open # ERROR: ld.so: object 'libfakeroot-sysv.so' from LD_PRELOAD cannot be preloaded (cannot open

5
apparmor.d/groups/children/child-dpkg-divert
View File

@ -1,5 +1,6 @@
# apparmor.d - Full set of apparmor profiles # apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov # Copyright (C) 2019-2021 Mikhail Morfikov
# Copyright (C) 2021-2023 Alexandre Pujol <alexandre@pujol.io>
# SPDX-License-Identifier: GPL-2.0-only # SPDX-License-Identifier: GPL-2.0-only
# Note: This profile does not specify an attachment path because it is # Note: This profile does not specify an attachment path because it is
@ -12,11 +13,11 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
# Do not attach to @{bin}/dpkg-divert by default @{exec_path} = @{bin}/dpkg-divert
profile child-dpkg-divert { profile child-dpkg-divert {
include <abstractions/base> include <abstractions/base>
@{bin}/dpkg-divert mr, @{exec_path} mr,
/var/lib/dpkg/arch r, /var/lib/dpkg/arch r,
/var/lib/dpkg/status r, /var/lib/dpkg/status r,

8
apparmor.d/groups/children/child-open
View File

@ -16,7 +16,8 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
# App allowed to open @{exec_path} = @{bin}/exo-open @{bin}/xdg-open
@{exec_path} += @{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop @{lib}/gio-launch-desktop
profile child-open { profile child-open {
include <abstractions/base> include <abstractions/base>
include <abstractions/dri-enumerate> include <abstractions/dri-enumerate>
@ -24,10 +25,7 @@ profile child-open {
include <abstractions/vulkan> include <abstractions/vulkan>
include <abstractions/xdg-open> include <abstractions/xdg-open>
@{bin}/exo-open mr, @{exec_path} mrix,
@{bin}/xdg-open mr,
@{lib}/@{multiarch}/glib-[0-9]*/gio-launch-desktop mrix,
@{lib}/gio-launch-desktop mrix,
@{bin}/{,ba,da}sh rix, @{bin}/{,ba,da}sh rix,
@{bin}/{,m,g}awk rix, @{bin}/{,m,g}awk rix,

6
apparmor.d/groups/children/child-pager
View File

@ -13,7 +13,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
# Do not attach to @{bin}/pager by default @{exec_path} = @{bin}/pager @{bin}/less @{bin}/more
profile child-pager { profile child-pager {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>
@ -24,9 +24,7 @@ profile child-pager {
signal (receive) set=(stop, cont, term, kill), signal (receive) set=(stop, cont, term, kill),
@{bin}/ r, @{bin}/ r,
@{bin}/pager mr, @{exec_path} mr,
@{bin}/less mr,
@{bin}/more mr,
@{system_share_dirs}/terminfo/{,**} r, @{system_share_dirs}/terminfo/{,**} r,

4
apparmor.d/groups/children/child-systemctl
View File

@ -13,7 +13,7 @@ abi <abi/3.0>,
include <tunables/global> include <tunables/global>
# Do not attach to @{bin}/systemctl by default @{exec_path} = @{bin}/systemctl
profile child-systemctl flags=(attach_disconnected) { profile child-systemctl flags=(attach_disconnected) {
include <abstractions/base> include <abstractions/base>
include <abstractions/consoles> include <abstractions/consoles>
@ -33,7 +33,7 @@ profile child-systemctl flags=(attach_disconnected) {
interface=org.freedesktop.systemd[0-9].Manager interface=org.freedesktop.systemd[0-9].Manager
member=GetUnitFileState, member=GetUnitFileState,
@{bin}/systemctl mr, @{exec_path} mr,
/etc/machine-id r, /etc/machine-id r,
/etc/systemd/user/{,**} rwl, /etc/systemd/user/{,**} rwl,