apparmor.d/apparmor.d/profiles-g-l/hardinfo
Alexandre Pujol 557d905543
Merge branch 'tunables' of https://github.com/nobody43/apparmor.d into nobody43-tunables
* 'tunables' of https://github.com/nobody43/apparmor.d:
  dbus temp tails
  Update apparmor.d
  Update gdm-runtime-config
  more unrelated changes
  adjust date-time
  random tails
  rename to int, convert more profiles
  fixes
  tunables
2023-08-17 20:01:53 +01:00

200 lines
4.5 KiB
Plaintext

# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = @{bin}/hardinfo
profile hardinfo @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/fontconfig-cache-read>
include <abstractions/fonts>
include <abstractions/freedesktop.org>
include <abstractions/gtk>
include <abstractions/nameservice-strict>
include <abstractions/python>
include <abstractions/user-download-strict>
# This is needed to display some content of devices -> resources
capability sys_admin,
# This is for benchmarks
capability sys_nice,
network inet dgram,
network inet6 dgram,
network inet stream,
network inet6 stream,
@{exec_path} mrix,
@{bin}/{,ba,da}sh rix,
@{bin}/gdb rix,
@{bin}/iconv rix,
@{bin}/last rix,
@{bin}/ldd rix,
@{bin}/locale rix,
@{bin}/make rix,
@{bin}/perl rix,
@{bin}/python2.[0-9]* rix,
@{bin}/python3.[0-9]* rix,
@{bin}/route rix,
@{bin}/ruby[0-9].[0-9]* rix,
@{bin}/strace rix,
@{bin}/tr rix,
@{bin}/valgrind{,.bin} rix,
@{lib}/@{multiarch}/valgrind/memcheck-*-linux rix,
@{bin}/lsb_release rPx -> lsb_release,
@{bin}/xdg-open rCx -> open,
@{bin}/ccache rCx -> ccache,
@{bin}/kmod rCx -> kmod,
@{bin}/glxinfo rPx,
@{bin}/xdpyinfo rPx,
@{bin}/lspci rPx,
@{bin}/lsusb rPx,
@{bin}/netstat rPx,
@{bin}/qtchooser rPx,
@{lib}/jvm/java-[0-9]*-openjdk-amd64/bin/javac rCx -> javac,
/usr/share/hardinfo/{,**} r,
@{sys}/class/power_supply/ r,
@{sys}/class/thermal/ r,
@{sys}/bus/i2c/drivers/eeprom/ r,
@{sys}/devices/system/cpu/** r,
@{sys}/devices/virtual/dmi/id/* r,
@{sys}/devices/virtual/thermal/thermal_zone[0-9]/hwmon[0-9]/temp* r,
@{sys}/devices/virtual/thermal/thermal_zone[0-9]/temp* r,
@{sys}/devices/platform/**/hwmon/hwmon[0-9]*/temp* r,
@{sys}/devices/platform/**/hwmon/hwmon[0-9]*/fan* r,
@{sys}/devices/pci[0-9]*/**/eeprom r,
@{sys}/devices/pci[0-9]*/**/hwmon/hwmon[0-9]*/temp* r,
@{sys}/devices/**/power_supply/** r,
@{PROC}/@{pid}/net/wireless r,
@{PROC}/@{pid}/net/dev r,
@{PROC}/@{pid}/net/arp r,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/mounts r,
@{PROC}/@{pids}/loginuid r,
@{PROC}/uptime r,
@{PROC}/loadavg r,
@{PROC}/ioports r,
@{PROC}/iomem r,
@{PROC}/dma r,
@{PROC}/asound/cards r,
@{PROC}/scsi/scsi r,
@{PROC}/bus/input/devices r,
@{PROC}/sys/kernel/random/entropy_avail r,
@{PROC}/@{pids}/net/route r,
/etc/fstab r,
/etc/exports r,
/etc/samba/smb.conf r,
/etc/gdb/gdbinit.d/ r,
/usr/share/gdb/python/ r,
/usr/share/gdb/python/** r,
/var/log/wtmp r,
owner @{HOME}/.hardinfo/ rw,
owner /tmp/#@{int} rw,
# Allowed apps to open
@{lib}/firefox/firefox rPUx,
# Silencer
deny /usr/share/gdb/python/** w,
# file_inherit
owner /dev/tty[0-9]* rw,
profile ccache {
include <abstractions/base>
@{bin}/ccache mr,
@{lib}/llvm-[0-9]*/bin/clang rix,
@{bin}/{,@{multiarch}-}gcc-[0-9]* rix,
@{bin}/{,@{multiarch}-}g++-[0-9]* rix,
/media/ccache/*/** rw,
/etc/debian_version r,
}
profile javac {
include <abstractions/base>
include <abstractions/nameservice-strict>
@{lib}/jvm/java-[0-9]*-openjdk-amd64/bin/* mr,
@{lib}/jvm/java-[0-9]*-openjdk-amd64/lib/** mr,
/etc/java-[0-9]*-openjdk/** r,
/usr/share/java/*.jar r,
owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/cgroup r,
owner @{PROC}/@{pid}/coredump_filter rw,
@{sys}/fs/cgroup/{,**} r,
owner /tmp/hsperfdata_*/ rw,
owner /tmp/hsperfdata_*/@{pid} rw,
}
profile open {
include <abstractions/base>
include <abstractions/xdg-open>
@{bin}/xdg-open mr,
@{bin}/{,ba,da}sh rix,
@{bin}/{m,g,}awk rix,
@{bin}/readlink rix,
@{bin}/basename rix,
owner @{HOME}/ r,
owner @{run}/user/@{uid}/ r,
# Allowed apps to open
@{lib}/firefox/firefox rPUx,
# file_inherit
owner @{HOME}/.xsession-errors w,
}
profile kmod {
include <abstractions/base>
@{bin}/kmod mr,
@{sys}/module/** r,
@{PROC}/cmdline r,
@{PROC}/modules r,
@{PROC}/ioports r,
}
include if exists <local/hardinfo>
}