mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-11-14 23:43:56 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Read-only root compatibility (#86)

Browse Source 
* Read-only root compatibility

* remove complain

Co-authored-by: nobodysu <nobodysu@users.noreply.github.com>
This commit is contained in:
nobody43 2022-10-18 18:23:52 +00:00 committed by GitHub
parent 5fdbc2d00e
commit f94faf697e
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
13 changed files with 26 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
apparmor.d/groups/network/NetworkManager
View File

@ -105,8 +105,8 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) {
/ r,
/etc/ r,
/etc/machine-id r,
/etc/resolv.conf rw,
/etc/resolv.conf.[0-9A-Z]* rw,
@{etc_rw}/resolv.conf rw,
@{etc_rw}/resolv.conf.[0-9A-Z]* rw,
/etc/network/interfaces r,
/etc/network/interfaces.d/{,*} r,

6
apparmor.d/groups/network/mullvad-daemon
View File

@ -36,8 +36,8 @@ profile mullvad-daemon @{exec_path} flags=(attach_disconnected) {
/etc/mullvad-vpn/{,*} r,
/etc/mullvad-vpn/*.json rw,
/etc/resolv.conf rw,
/etc/resolv.conf.mullvadbackup rw,
@{etc_rw}/resolv.conf rw,
@{etc_rw}/resolv.conf.mullvadbackup rw,
/var/cache/mullvad-vpn/{,*} rw,
/var/log/mullvad-vpn/{,*} rw,
@ -59,4 +59,4 @@ profile mullvad-daemon @{exec_path} flags=(attach_disconnected) {
/dev/net/tun rw,
include if exists <local/mullvad-daemon>
}
}

8
apparmor.d/groups/network/tailscaled
View File

@ -37,9 +37,9 @@ profile tailscaled @{exec_path} flags=(attach_disconnected) {
/etc/iproute2/rt_tables r,
/etc/resolv.*.conf rw,
/etc/resolv.conf rw,
/etc/resolv.conf.*.tmp rw,
@{etc_rw}/resolv.*.conf rw,
@{etc_rw}/resolv.conf rw,
@{etc_rw}/resolv.conf.*.tmp rw,
owner @{run}/tailscale/{,**} rw,
owner /var/cache/{,**} rw,
@ -80,4 +80,4 @@ profile tailscaled @{exec_path} flags=(attach_disconnected) {
}
include if exists <local/tailscaled>
}
}

4
apparmor.d/groups/systemd/systemd-timedated
View File

@ -34,8 +34,8 @@ profile systemd-timedated @{exec_path} flags=(attach_disconnected) {
/dev/rtc[0-9] r,
/etc/.#adjtime* rw,
/etc/adjtime rw,
@{etc_rw}/.#adjtime* rw,
@{etc_rw}/adjtime rw,
/etc/.#localtime* rw,
/etc/localtime rw,

2
apparmor.d/groups/systemd/systemd-timesyncd
View File

@ -31,7 +31,7 @@ profile systemd-timesyncd @{exec_path} flags=(attach_disconnected) {
@{exec_path} mr,
/etc/adjtime r,
@{etc_rw}/adjtime r,
/etc/systemd/timesyncd.conf r,
/etc/systemd/timesyncd.conf.d/{,**} r,

6
apparmor.d/groups/virt/libvirtd
View File

@ -132,8 +132,8 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) {
/usr/share/mime/mime.cache r,
/usr/share/qemu/{,**} r,
/etc/apparmor.d/libvirt/libvirt-@{uuid} r,
/etc/libvirt/{,**} rw,
@{etc_rw}/apparmor.d/libvirt/libvirt-@{uuid} r,
@{etc_rw}/libvirt/{,**} rw,
/etc/mdevctl.d/{,**} r,
/etc/xml/catalog r,
@ -243,7 +243,7 @@ profile libvirtd @{exec_path} flags=(attach_disconnected) {
# Force the use of virt-aa-helper
audit deny /{usr/,}{s,}bin/apparmor_parser rwxl,
audit deny /etc/apparmor.d/libvirt/** wxl,
audit deny @{etc_rw}/apparmor.d/libvirt/** wxl,
audit deny @{sys}/kernel/security/apparmor/features rwxl,
audit deny @{sys}/kernel/security/apparmor/matching rwxl,
audit deny @{sys}/kernel/security/apparmor/.* rwxl,

2
apparmor.d/groups/virt/virt-aa-helper
View File

@ -23,7 +23,7 @@ profile virt-aa-helper @{exec_path} {
/{usr/,}{s,}bin/apparmor_parser rPx,
/etc/apparmor.d/libvirt/* r,
/etc/apparmor.d/libvirt/libvirt-@{uuid} rw,
@{etc_rw}/apparmor.d/libvirt/libvirt-@{uuid} rw,
/etc/libnl{,-3}/classid r, # Allow reading libnl's classid file

4
apparmor.d/profiles-a-f/blkid
View File

@ -23,8 +23,8 @@ profile blkid @{exec_path} {
@{run}/blkid/blkid.tab{,-*} rw,
@{run}/blkid/blkid.tab.old rwl -> @{run}/blkid/blkid.tab,
# When the system doesn't have the /run/ dir, the cache file is placed under /etc/
/etc/blkid.tab{,-*} rw,
/etc/blkid.tab.old rwl -> /etc/blkid.tab,
@{etc_rw}/blkid.tab{,-*} rw,
@{etc_rw}/blkid.tab.old rwl -> /etc/blkid.tab,
# For the EVALUATE=scan method
@{PROC}/partitions r,

6
apparmor.d/profiles-a-f/dhclient-script
View File

@ -50,9 +50,9 @@ profile dhclient-script @{exec_path} {
/etc/fstab r,
/etc/iproute2/rt_tables r,
/etc/iproute2/rt_tables.d/{,*} r,
/etc/resolv.conf rw,
/etc/resolv.conf.dhclient-new.@{pid} rw,
/etc/samba/dhcp.conf{,.new} rw,
@{etc_rw}/resolv.conf rw,
@{etc_rw}/resolv.conf.dhclient-new.@{pid} rw,
@{etc_rw}/samba/dhcp.conf{,.new} rw,
/var/lib/dhcp/dhclient.leases r,
/var/lib/samba/dhcp.conf{,.new} rw,

2
apparmor.d/profiles-g-l/lvm
View File

@ -19,7 +19,7 @@ profile lvm @{exec_path} {
@{exec_path} rm,
/etc/lvm/** r,
@{etc_rw}/lvm/** r,
@{run}/lvm/** rwk,
@{run}/lock/lvm/* rwk,

3
apparmor.d/profiles-g-l/lvmconfig
View File

@ -13,8 +13,7 @@ profile lvmconfig @{exec_path} {
@{exec_path} rm,
/etc/lvm/** rw,
@{etc_rw}/lvm/** rw,
include if exists <local/lvmconfig>
}

2
apparmor.d/profiles-m-r/polipo
View File

@ -22,7 +22,7 @@ profile polipo @{exec_path} {
owner @{HOME}/.polipo-cache/{,*} rw,
# Nameservice
/etc/resolv.conf r,
@{etc_rw}/resolv.conf r,
include if exists <local/polipo>
}

4
apparmor.d/profiles-m-r/resolvconf
View File

@ -26,7 +26,7 @@ profile resolvconf @{exec_path} {
/usr/lib/resolvconf/{,**} r,
/etc/resolv.conf rw,
@{etc_rw}/resolv.conf rw,
/etc/resolvconf/{,**} r,
/etc/resolvconf/update.d/libc rix,
@ -36,4 +36,4 @@ profile resolvconf @{exec_path} {
/dev/tty rw,
include if exists <local/resolvconf>
}
}