mirrors/apparmor.d
1
0
Fork 0
mirror of https://github.com/roddhjav/apparmor.d.git synced 2024-11-14 23:43:56 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

feat(profiles): general update.

Browse Source
This commit is contained in:
Alexandre Pujol 2023-02-11 19:03:01 +00:00
parent 2242c2185a
commit fbd5996531
No known key found for this signature in database
GPG Key ID: C5469996F0DF68EC
14 changed files with 70 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
apparmor.d/groups/children/child-systemctl
View File

@ -29,7 +29,7 @@ profile child-systemctl flags=(attach_disconnected) {
network inet stream,
network inet6 stream,
dbus send bus=system path=/org/freedesktop/systemd[0-9]/Unit
dbus send bus=system path=/org/freedesktop/systemd1{,/Unit}
interface=org.freedesktop.systemd[0-9].Manager
member=GetUnitFileState,

4
apparmor.d/groups/freedesktop/pipewire
View File

@ -75,9 +75,7 @@ profile pipewire @{exec_path} flags=(attach_disconnected) {
@{sys}/class/ r,
@{sys}/devices/**/device:*/**/path r,
@{sys}/devices/pci[0-9]*/**/usb[0-9]/**/{idVendor,idProduct,removable,uevent} r,
@{sys}/devices/virtual/dmi/id/bios_vendor r,
@{sys}/devices/virtual/dmi/id/board_vendor r,
@{sys}/devices/virtual/dmi/id/product_name r,
@{sys}/devices/virtual/dmi/id/{sys_vendor,product_version,product_name} r,
/dev/media[0-9]* rw,

1
apparmor.d/groups/gnome/gnome-software
View File

@ -99,6 +99,7 @@ profile gnome-software @{exec_path} {
@{sys}/module/nvidia/version r,
@{PROC}/@{pids}/mounts r,
@{PROC}/sys/fs/pipe-max-size r,
@{PROC}/sys/kernel/random/boot_id r,
owner @{PROC}/@{pid}/stat r,

4
apparmor.d/groups/network/NetworkManager
View File

@ -35,6 +35,8 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) {
network netlink raw,
network packet dgram,
signal (send) set=(term) peer=dnsmasq,
dbus (send,receive) bus=system path=/org/freedesktop/NetworkManager{,/**}
interface=org.freedesktop.{DBus.Properties,DBus.Introspectable,NetworkManager*},
@ -88,8 +90,10 @@ profile NetworkManager @{exec_path} flags=(attach_disconnected) {
@{exec_path} mr,
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/nft rix,
/{usr/,}bin/dnsmasq rPx,
/{usr/,}bin/kmod rPx,
/{usr/,}bin/resolvconf rPx,
/{usr/,}bin/systemctl rPx -> child-systemctl,
@{libexec}/{,NetworkManager/}nm-dhcp-helper rPx,

3
apparmor.d/groups/network/tailscaled
View File

@ -30,8 +30,9 @@ profile tailscaled @{exec_path} flags=(attach_disconnected) {
@{exec_path} mr,
/{usr/,}bin/ip rix,
/{usr/,}{s,}bin/xtables-nft-multi rix,
/{usr/,}bin/ip rix,
/{usr/,}bin/resolvectl rPx,
/{usr/,}bin/systemctl rCx -> systemctl,

6
apparmor.d/groups/pacman/pacman
View File

@ -159,10 +159,10 @@ profile pacman @{exec_path} {
/{usr/,}bin/gpg-agent rix,
/{usr/,}bin/gpg-connect-agent rix,
@{HOME}/@{XDG_GPG_DIR}/*.conf r,
/etc/pacman.d/gnupg/ rw,
/etc/pacman.d/gnupg/** rwkl,
owner /etc/pacman.d/gnupg/ rw,
owner /etc/pacman.d/gnupg/** rwkl,
@{HOME}/@{XDG_GPG_DIR}/*.conf r,
deny network inet stream,
deny network inet6 stream,

1
apparmor.d/groups/systemd/journalctl
View File

@ -47,6 +47,7 @@ profile journalctl @{exec_path} flags=(attach_disconnected) {
owner @{PROC}/@{pid}/cgroup r,
deny @{user_share_dirs}/gvfs-metadata/* r,
deny /apparmor/.null rw,
include if exists <local/systemd-journalctl>

9
apparmor.d/groups/ubuntu/software-properties-gtk
View File

@ -18,7 +18,11 @@ profile software-properties-gtk @{exec_path} {
include <abstractions/openssl>
include <abstractions/python>
dbus send bus=system path=/{,com/canonical/UbuntuAdvantage/Manager}
dbus (send,receive) bus=system path=/com/canonical/UbuntuAdvantage/{,**}
interface=org.freedesktop.DBus.Introspectable
member=Introspect,
dbus send bus=system path=/
interface=org.freedesktop.DBus.Introspectable
member=Introspect,
@ -79,5 +83,8 @@ profile software-properties-gtk @{exec_path} {
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/mounts r,
# Silencer
deny @{user_share_dirs}/gvfs-metadata/* r,
include if exists <local/software-properties-gtk>
}

19
apparmor.d/groups/ubuntu/ubuntu-advantage
View File

@ -23,12 +23,27 @@ profile ubuntu-advantage @{exec_path} {
@{exec_path} mr,
/{usr/,}bin/dpkg rPx -> child-dpkg,
/{usr/,}bin/ischroot rix,
/etc/ubuntu-advantage/uaclient.conf r,
/{usr/,}bin/apt-cache rPx,
/{usr/,}bin/apt-get rPx,
/{usr/,}bin/dpkg rPx -> child-dpkg,
/{usr/,}bin/ps rPx,
/{usr/,}bin/snap rPx,
/{usr/,}bin/systemctl rPx -> child-systemctl,
/{usr/,}lib/apt/apt-helper rix,
/{usr/,}lib/apt/methods/http{,s} rPx,
/{usr/,}lib/ubuntu-advantage/apt-esm-hook rPx,
/{usr/,}bin/systemd-detect-virt rPx,
/etc/ubuntu-advantage/{,**} r,
/var/lib/ubuntu-advantage/{,**} r,
owner /tmp/tmp[0-9a-z]*/apt.conf r,
@{run}/ubuntu-advantage/{,**} rw,
@{PROC}/version_signature r,
owner @{PROC}/@{pid}/fd/ r,
include if exists <local/ubuntu-advantage>

6
apparmor.d/groups/ubuntu/ubuntu-advantage-desktop-daemon
View File

@ -19,7 +19,7 @@ profile ubuntu-advantage-desktop-daemon @{exec_path} flags=(attach_disconnected)
member=RequestName
peer=(name=org.freedesktop.DBus),
dbus receive bus=system path=/com/canonical/UbuntuAdvantage/Manager
dbus receive bus=system path=/com/canonical/UbuntuAdvantage/{Manager,Service/*}
interface=org.freedesktop.DBus.Introspectable
member=Introspect,
@ -36,5 +36,9 @@ profile ubuntu-advantage-desktop-daemon @{exec_path} flags=(attach_disconnected)
@{exec_path} mr,
/{usr/,}bin/ubuntu-advantage rPx,
/var/lib/ubuntu-advantage/{,**} r,
include if exists <local/ubuntu-advantage-desktop-daemon>
}

4
apparmor.d/groups/ubuntu/update-notifier
View File

@ -31,7 +31,9 @@ profile update-notifier @{exec_path} {
/{usr/,}bin/dpkg rPx -> child-dpkg,
/{usr/,}bin/lsb_release rPx -> lsb_release,
/{usr/,}bin/pkexec rPx,
/{usr/,}bin/pkexec rPx, # TODO: rCx or rix to run /usr/lib/update-notifier/package-system-locked
/{usr/,}bin/snap rPx,
/{usr/,}bin/software-properties-gtk rPx,
/{usr/,}bin/systemctl rPx -> child-systemctl,
/{usr/,}bin/update-manager rPx,
/{usr/,}lib/ubuntu-release-upgrader/check-new-release-gtk rPx,

4
apparmor.d/profiles-a-f/apparmor_parser
View File

@ -23,10 +23,12 @@ profile apparmor_parser @{exec_path} flags=(attach_disconnected) {
/usr/share/apparmor-features/{,**} r,
/usr/share/apparmor/{,**} r,
owner /snap/core[0-9]*/[0-9]*/etc/apparmor.d/{,**} r,
owner /var/cache/apparmor/{,**} rw,
owner /var/lib/docker/tmp/docker-default[0-9]* r,
owner /var/lib/snapd/apparmor/{,**} r,
owner /var/snap/lxd/common/lxd/security/apparmor/{,**} r,
owner /tmp/cri-containerd.apparmor.d[0-9]* r,
@{sys}/kernel/security/apparmor/{,**} r,

2
apparmor.d/profiles-m-r/pcscd
View File

@ -25,7 +25,7 @@ profile pcscd @{exec_path} {
owner @{run}/pcscd/{,pcscd.pid} rw,
owner @{PROC}/@{pid}/stat r,
@{PROC}/@{pids}/stat r,
include if exists <local/pcscd>
}

21
apparmor.d/profiles-s-z/steam
View File

@ -60,7 +60,7 @@ profile steam @{exec_path} {
/{usr/,}bin/ldd rix,
/{usr/,}bin/ln rix,
/{usr/,}bin/lsb_release rPx -> lsb_release,
/{usr/,}bin/lspci rPx,
/{usr/,}bin/lspci rCx -> lspci,
/{usr/,}bin/mkdir rix,
/{usr/,}bin/mv rix,
/{usr/,}bin/readlink rix,
@ -227,5 +227,24 @@ profile steam @{exec_path} {
audit deny /**.steam_exec_test.sh rw,
deny owner @{user_share_dirs}/gvfs-metadata/{,*} r,
profile lspci {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/nameservice-strict>
/{usr/,}bin/lspci mr,
owner @{HOME}/.steam/steam.pipe r,
@{sys}/bus/pci/devices/ r,
@{sys}/bus/pci/slots/ r,
@{sys}/bus/pci/slots/[0-9]*/address r,
@{sys}/devices/pci[0-9]*/** r,
owner /dev/shm/ValveIPCSHM_@{uid} rw,
include if exists <local/steam_lspci>
}
include if exists <local/steam>
}