mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2024-11-16 00:13:48 +01:00
557d905543
* 'tunables' of https://github.com/nobody43/apparmor.d: dbus temp tails Update apparmor.d Update gdm-runtime-config more unrelated changes adjust date-time random tails rename to int, convert more profiles fixes tunables
200 lines
4.5 KiB
Plaintext
200 lines
4.5 KiB
Plaintext
# apparmor.d - Full set of apparmor profiles
|
|
# Copyright (C) 2019-2021 Mikhail Morfikov
|
|
# SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
abi <abi/3.0>,
|
|
|
|
include <tunables/global>
|
|
|
|
@{exec_path} = @{bin}/hardinfo
|
|
profile hardinfo @{exec_path} {
|
|
include <abstractions/base>
|
|
include <abstractions/consoles>
|
|
include <abstractions/fontconfig-cache-read>
|
|
include <abstractions/fonts>
|
|
include <abstractions/freedesktop.org>
|
|
include <abstractions/gtk>
|
|
include <abstractions/nameservice-strict>
|
|
include <abstractions/python>
|
|
include <abstractions/user-download-strict>
|
|
|
|
# This is needed to display some content of devices -> resources
|
|
capability sys_admin,
|
|
|
|
# This is for benchmarks
|
|
capability sys_nice,
|
|
|
|
network inet dgram,
|
|
network inet6 dgram,
|
|
network inet stream,
|
|
network inet6 stream,
|
|
|
|
@{exec_path} mrix,
|
|
|
|
@{bin}/{,ba,da}sh rix,
|
|
@{bin}/gdb rix,
|
|
@{bin}/iconv rix,
|
|
@{bin}/last rix,
|
|
@{bin}/ldd rix,
|
|
@{bin}/locale rix,
|
|
@{bin}/make rix,
|
|
@{bin}/perl rix,
|
|
@{bin}/python2.[0-9]* rix,
|
|
@{bin}/python3.[0-9]* rix,
|
|
@{bin}/route rix,
|
|
@{bin}/ruby[0-9].[0-9]* rix,
|
|
@{bin}/strace rix,
|
|
@{bin}/tr rix,
|
|
@{bin}/valgrind{,.bin} rix,
|
|
@{lib}/@{multiarch}/valgrind/memcheck-*-linux rix,
|
|
|
|
@{bin}/lsb_release rPx -> lsb_release,
|
|
@{bin}/xdg-open rCx -> open,
|
|
@{bin}/ccache rCx -> ccache,
|
|
@{bin}/kmod rCx -> kmod,
|
|
|
|
@{bin}/glxinfo rPx,
|
|
@{bin}/xdpyinfo rPx,
|
|
@{bin}/lspci rPx,
|
|
@{bin}/lsusb rPx,
|
|
@{bin}/netstat rPx,
|
|
@{bin}/qtchooser rPx,
|
|
|
|
@{lib}/jvm/java-[0-9]*-openjdk-amd64/bin/javac rCx -> javac,
|
|
|
|
/usr/share/hardinfo/{,**} r,
|
|
|
|
@{sys}/class/power_supply/ r,
|
|
@{sys}/class/thermal/ r,
|
|
@{sys}/bus/i2c/drivers/eeprom/ r,
|
|
|
|
@{sys}/devices/system/cpu/** r,
|
|
@{sys}/devices/virtual/dmi/id/* r,
|
|
@{sys}/devices/virtual/thermal/thermal_zone[0-9]/hwmon[0-9]/temp* r,
|
|
@{sys}/devices/virtual/thermal/thermal_zone[0-9]/temp* r,
|
|
@{sys}/devices/platform/**/hwmon/hwmon[0-9]*/temp* r,
|
|
@{sys}/devices/platform/**/hwmon/hwmon[0-9]*/fan* r,
|
|
@{sys}/devices/pci[0-9]*/**/eeprom r,
|
|
@{sys}/devices/pci[0-9]*/**/hwmon/hwmon[0-9]*/temp* r,
|
|
@{sys}/devices/**/power_supply/** r,
|
|
|
|
@{PROC}/@{pid}/net/wireless r,
|
|
@{PROC}/@{pid}/net/dev r,
|
|
@{PROC}/@{pid}/net/arp r,
|
|
owner @{PROC}/@{pid}/fd/ r,
|
|
owner @{PROC}/@{pid}/mountinfo r,
|
|
owner @{PROC}/@{pid}/mounts r,
|
|
@{PROC}/@{pids}/loginuid r,
|
|
@{PROC}/uptime r,
|
|
@{PROC}/loadavg r,
|
|
@{PROC}/ioports r,
|
|
@{PROC}/iomem r,
|
|
@{PROC}/dma r,
|
|
@{PROC}/asound/cards r,
|
|
@{PROC}/scsi/scsi r,
|
|
@{PROC}/bus/input/devices r,
|
|
@{PROC}/sys/kernel/random/entropy_avail r,
|
|
@{PROC}/@{pids}/net/route r,
|
|
|
|
/etc/fstab r,
|
|
/etc/exports r,
|
|
/etc/samba/smb.conf r,
|
|
|
|
/etc/gdb/gdbinit.d/ r,
|
|
|
|
/usr/share/gdb/python/ r,
|
|
/usr/share/gdb/python/** r,
|
|
|
|
/var/log/wtmp r,
|
|
|
|
owner @{HOME}/.hardinfo/ rw,
|
|
|
|
owner /tmp/#@{int} rw,
|
|
|
|
# Allowed apps to open
|
|
@{lib}/firefox/firefox rPUx,
|
|
|
|
# Silencer
|
|
deny /usr/share/gdb/python/** w,
|
|
|
|
# file_inherit
|
|
owner /dev/tty[0-9]* rw,
|
|
|
|
|
|
profile ccache {
|
|
include <abstractions/base>
|
|
|
|
@{bin}/ccache mr,
|
|
|
|
@{lib}/llvm-[0-9]*/bin/clang rix,
|
|
@{bin}/{,@{multiarch}-}gcc-[0-9]* rix,
|
|
@{bin}/{,@{multiarch}-}g++-[0-9]* rix,
|
|
|
|
/media/ccache/*/** rw,
|
|
|
|
/etc/debian_version r,
|
|
|
|
}
|
|
|
|
profile javac {
|
|
include <abstractions/base>
|
|
include <abstractions/nameservice-strict>
|
|
|
|
@{lib}/jvm/java-[0-9]*-openjdk-amd64/bin/* mr,
|
|
|
|
@{lib}/jvm/java-[0-9]*-openjdk-amd64/lib/** mr,
|
|
|
|
/etc/java-[0-9]*-openjdk/** r,
|
|
|
|
/usr/share/java/*.jar r,
|
|
|
|
owner @{PROC}/@{pid}/mountinfo r,
|
|
owner @{PROC}/@{pid}/cgroup r,
|
|
owner @{PROC}/@{pid}/coredump_filter rw,
|
|
|
|
@{sys}/fs/cgroup/{,**} r,
|
|
|
|
owner /tmp/hsperfdata_*/ rw,
|
|
owner /tmp/hsperfdata_*/@{pid} rw,
|
|
|
|
}
|
|
|
|
profile open {
|
|
include <abstractions/base>
|
|
include <abstractions/xdg-open>
|
|
|
|
@{bin}/xdg-open mr,
|
|
|
|
@{bin}/{,ba,da}sh rix,
|
|
@{bin}/{m,g,}awk rix,
|
|
@{bin}/readlink rix,
|
|
@{bin}/basename rix,
|
|
|
|
owner @{HOME}/ r,
|
|
|
|
owner @{run}/user/@{uid}/ r,
|
|
|
|
# Allowed apps to open
|
|
@{lib}/firefox/firefox rPUx,
|
|
|
|
# file_inherit
|
|
owner @{HOME}/.xsession-errors w,
|
|
|
|
}
|
|
|
|
profile kmod {
|
|
include <abstractions/base>
|
|
|
|
@{bin}/kmod mr,
|
|
|
|
@{sys}/module/** r,
|
|
|
|
@{PROC}/cmdline r,
|
|
@{PROC}/modules r,
|
|
@{PROC}/ioports r,
|
|
|
|
}
|
|
|
|
include if exists <local/hardinfo>
|
|
}
|