# vim:syntax=apparmor # ------------------------------------------------------------------ # # Copyright (C) 2019-2021 Mikhail Morfikov # # This program is free software; you can redistribute it and/or # modify it under the terms of version 2 of the GNU General Public # License published by the Free Software Foundation. # # ------------------------------------------------------------------ abi , include @{exec_path} = /{usr/,}bin/su profile su @{exec_path} { include include include include include # include # To remove the following errors: # su: cannot set groups: Operation not permitted capability setgid, # To remove the following errors: # su: cannot set user id: Operation not permitted capability setuid, # To write records to the kernel auditing log. capability audit_write, # Needed? audit deny capability net_bind_service, signal (send) set=(term,kill), signal (receive) set=(int,quit,term), network netlink raw, @{exec_path} mr, # Shells to use /{usr/,}bin/{,b,d,rb}ash rpux, /{usr/,}bin/{c,k,tc,z}sh rpux, # Fake shells to politely refuse a login #/{usr/,}sbin/nologin rpux, /etc/environment r, @{PROC}/1/limits r, owner @{PROC}/@{pid}/loginuid r, /etc/default/locale r, /etc/security/limits.d/ r, /etc/shells r, # For pam_securetty @{PROC}/cmdline r, @{sys}/devices/virtual/tty/console/active r, include if exists }