mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2024-11-16 00:13:48 +01:00
96 lines
3.1 KiB
Plaintext
96 lines
3.1 KiB
Plaintext
# apparmor.d - Full set of apparmor profiles
|
|
# Copyright (C) 2019-2021 Mikhail Morfikov
|
|
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
|
|
# SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
abi <abi/3.0>,
|
|
|
|
# The /sys/ entries probably should be tightened
|
|
|
|
/dev/ r,
|
|
/dev/block/ r,
|
|
/dev/disk/{,*/} r,
|
|
|
|
# Regular disk/partition devices
|
|
/dev/{s,v}d[a-z]* rwk,
|
|
/dev/{s,v}d[a-z]*[0-9]* rwk,
|
|
@{sys}/devices/pci[0-9]*/**/block/{s,v}d[a-z]/ r,
|
|
@{sys}/devices/pci[0-9]*/**/block/{s,v}d[a-z]/** r,
|
|
@{sys}/devices/pci[0-9]*/**/{usb,ata}[0-9]/** r,
|
|
|
|
# SSD Nvme devices
|
|
/dev/nvme[0-9]* rwk,
|
|
@{sys}/devices/pci[0-9]*/**/nvme/nvme[0-9]*/{,**} r,
|
|
|
|
# SD card devices
|
|
/dev/mmcblk[0-9]* rwk,
|
|
/dev/mmcblk[0-9]*p[0-9]* rwk,
|
|
@{sys}/devices/pci[0-9]*/**/block/mmcblk[0-9]*/ r,
|
|
@{sys}/devices/pci[0-9]*/**/block/mmcblk[0-9]*/** r,
|
|
@{sys}/devices/pci[0-9]*/**/mmc[0-9]*/mmc*/ r,
|
|
@{sys}/devices/pci[0-9]*/**/mmc[0-9]*/mmc*/** r,
|
|
|
|
# Loop devices
|
|
/dev/loop[0-9]* rwk,
|
|
/dev/loop[0-9]*p[0-9]* rwk,
|
|
@{sys}/devices/virtual/block/loop[0-9]*/ r,
|
|
@{sys}/devices/virtual/block/loop[0-9]*/** r,
|
|
|
|
# LUKS/LVM (device-mapper) devices
|
|
/dev/dm-[0-9]* rwk,
|
|
/dev/mapper/{,*} rw,
|
|
@{sys}/devices/virtual/block/dm-[0-9]*/ r,
|
|
@{sys}/devices/virtual/block/dm-[0-9]*/** r,
|
|
|
|
# ZFS devices
|
|
/dev/zd[0-9]* rwk,
|
|
@{sys}/devices/virtual/block/zd[0-9]*/ r,
|
|
@{sys}/devices/virtual/block/zd[0-9]*/** r,
|
|
|
|
# ZRAM devices
|
|
/dev/zram[0-9]* rwk,
|
|
@{sys}/devices/virtual/block/zram[0-9]*/ r,
|
|
@{sys}/devices/virtual/block/zram[0-9]*/** r,
|
|
|
|
# NBD devices
|
|
/dev/nbd* rwk,
|
|
@{sys}/devices/virtual/block/nbd[0-9]*/ r,
|
|
@{sys}/devices/virtual/block/nbd[0-9]*/** r,
|
|
|
|
# Floppy disks
|
|
/dev/fd[0-9]* rwk,
|
|
@{sys}/devices/platform/floppy.[0-9]*/block/fd[0-9]/ r,
|
|
@{sys}/devices/platform/floppy.[0-9]*/block/fd[0-9]/** r,
|
|
|
|
# CD-ROM
|
|
/dev/sr[0-9]* rwk,
|
|
|
|
@{sys}/class/block/ r,
|
|
@{sys}/block/ r,
|
|
# To be able to look up each block device by major:minor numbers
|
|
@{sys}/dev/block/ r,
|
|
|
|
# According to the kernel docs[1], the major block numbers from 240 to 254 are allocated
|
|
# dynamically by the kernel for devices which don't have official numbers assigned. It looks like
|
|
# that "dm" (device mapper) and "zram" are such devices. To avoid issues when kernel config
|
|
# changes, it's better to allow the whole range (240-254) instead of the single major numbers
|
|
# visible in the /proc/devices file.
|
|
# [1]: https://raw.githubusercontent.com/torvalds/linux/master/Documentation/admin-guide/devices.txt
|
|
@{run}/udev/data/b24[0-9]:[0-9]* r,
|
|
@{run}/udev/data/b25[0-4]:[0-9]* r,
|
|
@{run}/udev/data/b259:[0-9]* r,
|
|
|
|
@{run}/udev/data/b11:[0-9]* r, # for /dev/sr*
|
|
@{run}/udev/data/b179:[0-9]* r, # for /dev/mmcblk*
|
|
@{run}/udev/data/b2:[0-9]* r, # for /dev/fd*
|
|
@{run}/udev/data/b230:[0-9]* r, # for /dev/zvol*
|
|
@{run}/udev/data/b43:[0-9]* r, # for /dev/nbd*
|
|
@{run}/udev/data/b7:[0-9]* r, # for /dev/loop*
|
|
@{run}/udev/data/b8:[0-9]* r, # for /dev/sd*
|
|
|
|
@{run}/udev/data/c189:[0-9]* r, # for /dev/bus/usb/**
|
|
|
|
@{run}/udev/data/+usb:* r, # for ?
|
|
|
|
include if exists <abstractions/disks-write.d>
|