mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2025-02-07 02:35:06 +01:00
112 lines
2.6 KiB
Text
112 lines
2.6 KiB
Text
# apparmor.d - Full set of apparmor profiles
|
|
# Copyright (C) 2018-2022 Mikhail Morfikov
|
|
# Copyright (C) 2022 Alexandre Pujol <alexandre@pujol.io>
|
|
# SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
abi <abi/3.0>,
|
|
|
|
include <tunables/global>
|
|
|
|
@{exec_path} = /{usr/,}{s,}bin/dhclient-script
|
|
profile dhclient-script @{exec_path} {
|
|
include <abstractions/base>
|
|
include <abstractions/nameservice>
|
|
include <abstractions/openssl>
|
|
include <abstractions/ssl_certs>
|
|
|
|
capability sys_admin,
|
|
|
|
# Needed?
|
|
audit deny capability sys_module,
|
|
|
|
@{exec_path} mr,
|
|
|
|
/{usr/,}bin/{,ba,da}sh mrix,
|
|
|
|
/{usr/,}bin/mkdir rix,
|
|
/{usr/,}bin/ping rPx,
|
|
/{usr/,}bin/chronyc rPUx,
|
|
/{usr/,}bin/run-parts rCx -> run-parts,
|
|
/{usr/,}sbin/resolvconf rPx,
|
|
|
|
# To remove the following error:
|
|
# /sbin/dhclient-script: 133: hostname: Permission denied
|
|
/{usr/,}bin/hostname rix,
|
|
|
|
# To read scripts
|
|
/etc/dhcp/ r,
|
|
/etc/dhcp/dhclient-{enter,exit}-hooks.d/{,*} r,
|
|
|
|
# For debug script
|
|
/{usr/,}bin/date rix,
|
|
/etc/dhcp/debug r,
|
|
owner /tmp/dhclient-script.debug rw,
|
|
|
|
# For ddclient script
|
|
/{usr/,}{s,}bin/ddclient rPx,
|
|
/etc/default/ddclient r,
|
|
/{usr/,}bin/logger rix,
|
|
|
|
# For samba script
|
|
/{usr/,}bin/mv rix,
|
|
/etc/samba/dhcp.conf{,.new} rw,
|
|
# For netbios name servers settings from a DHCP server
|
|
/var/lib/samba/dhcp.conf{,.new} rw,
|
|
|
|
# Many scripts may use the ip tool
|
|
capability net_admin,
|
|
/{usr/,}bin/ip rix,
|
|
|
|
# For loadbalance
|
|
/etc/iproute2/rt_tables r,
|
|
/etc/iproute2/rt_tables.d/{,*} r,
|
|
owner @{PROC}/@{pid}/loginuid r,
|
|
|
|
# For updating the /etc/resolv.conf file
|
|
/{usr/,}bin/readlink rix,
|
|
/{usr/,}bin/rm rix,
|
|
/{usr/,}bin/chown rix,
|
|
/{usr/,}bin/chmod rix,
|
|
/{usr/,}bin/sed rix,
|
|
/etc/fstab r,
|
|
/etc/resolv.conf.dhclient-new.@{pid} rw,
|
|
/etc/resolv.conf rw,
|
|
|
|
# For stable-privacy addresses
|
|
/{usr/,}{s,}bin/sysctl rix,
|
|
/{usr/,}bin/head rix,
|
|
/{usr/,}bin/xxd rix,
|
|
/{usr/,}bin/paste rix,
|
|
/{usr/,}bin/fold rix,
|
|
/{usr/,}bin/tr rix,
|
|
@{PROC}/sys/net/ipv6/conf/*/stable_secret w,
|
|
|
|
# For printing env
|
|
/{usr/,}bin/printenv rix,
|
|
owner /tmp/variables.txt w,
|
|
|
|
# For ntpd/ntpsec
|
|
@{run}/systemd/netif/leases/ r,
|
|
|
|
# For chrony
|
|
@{run}/chrony-dhcp/ rw,
|
|
|
|
# file_inherit
|
|
/var/lib/dhcp/dhclient.leases r,
|
|
|
|
@{sys}/devices/virtual/dmi/id/board_vendor r,
|
|
|
|
profile run-parts {
|
|
include <abstractions/base>
|
|
|
|
/{usr/,}bin/run-parts mr,
|
|
|
|
/etc/dhcp/dhclient-{enter,exit}-hooks.d/ r,
|
|
|
|
# file_inherit
|
|
owner /var/lib/dhcp/dhclient.leases r,
|
|
|
|
}
|
|
|
|
include if exists <local/dhclient-script>
|
|
}
|