mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2024-11-16 16:33:50 +01:00
86 lines
3.5 KiB
Plaintext
86 lines
3.5 KiB
Plaintext
# apparmor.d - Full set of apparmor profiles
|
|
# Copyright (C) 2019-2021 Mikhail Morfikov
|
|
# SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
abi <abi/3.0>,
|
|
|
|
# The /sys/ entries probably should be tightened
|
|
|
|
/dev/ r,
|
|
|
|
# Regular disk/partition devices
|
|
/dev/sd[a-z] rwk,
|
|
/dev/sd[a-z][0-9]* rwk,
|
|
@{sys}/devices/pci[0-9]*/**/block/sd[a-z]/ r,
|
|
@{sys}/devices/pci[0-9]*/**/block/sd[a-z]/** r,
|
|
@{sys}/devices/pci[0-9]*/**/{usb,ata}[0-9]/** r,
|
|
|
|
# SSD Nvme devices
|
|
/dev/nvme[0-9]* rwk,
|
|
@{sys}/devices/pci[0-9]*/**/nvme/nvme[0-9]*/{,**} r,
|
|
|
|
# SD card devices
|
|
/dev/mmcblk[0-9]* rwk,
|
|
/dev/mmcblk[0-9]*p[0-9]* rwk,
|
|
@{sys}/devices/pci[0-9]*/**/block/mmcblk[0-9]*/ r,
|
|
@{sys}/devices/pci[0-9]*/**/block/mmcblk[0-9]*/** r,
|
|
@{sys}/devices/pci[0-9]*/**/mmc[0-9]*/mmc*/ r,
|
|
@{sys}/devices/pci[0-9]*/**/mmc[0-9]*/mmc*/** r,
|
|
|
|
# Loop devices
|
|
/dev/loop[0-9]* rwk,
|
|
/dev/loop[0-9]*p[0-9]* rwk,
|
|
@{sys}/devices/virtual/block/loop[0-9]*/ r,
|
|
@{sys}/devices/virtual/block/loop[0-9]*/** r,
|
|
|
|
# LUKS/LVM (device-mapper) devices
|
|
/dev/dm-[0-9]* rwk,
|
|
@{sys}/devices/virtual/block/dm-[0-9]*/ r,
|
|
@{sys}/devices/virtual/block/dm-[0-9]*/** r,
|
|
|
|
# ZRAM devices
|
|
/dev/zram[0-9]* rwk,
|
|
@{sys}/devices/virtual/block/zram[0-9]*/ r,
|
|
@{sys}/devices/virtual/block/zram[0-9]*/** r,
|
|
|
|
# CD-ROM
|
|
/dev/sr[0-9]* rwk,
|
|
|
|
@{sys}/class/block/ r,
|
|
@{sys}/block/ r,
|
|
# To be able to look up each block device by major:minor numbers
|
|
@{sys}/dev/block/ r,
|
|
|
|
# According to the kernel docs[1], the major block numbers from 240 to 254 are allocated
|
|
# dynamically by the kernel for devices which don't have official numbers assigned. It looks like
|
|
# that "dm" (device mapper) and "zram" are such devices. To avoid issues when kernel config
|
|
# changes, it's better to allow the whole range (240-254) instead of the single major numbers
|
|
# visible in the /proc/devices file.
|
|
# [1]: https://raw.githubusercontent.com/torvalds/linux/master/Documentation/admin-guide/devices.txt
|
|
@{run}/udev/data/b254:[0-9]* r, # for dynamic kernel assignment of block devices
|
|
@{run}/udev/data/b253:[0-9]* r, # for dynamic kernel assignment of block devices
|
|
@{run}/udev/data/b252:[0-9]* r, # for dynamic kernel assignment of block devices
|
|
@{run}/udev/data/b251:[0-9]* r, # for dynamic kernel assignment of block devices
|
|
@{run}/udev/data/b250:[0-9]* r, # for dynamic kernel assignment of block devices
|
|
@{run}/udev/data/b249:[0-9]* r, # for dynamic kernel assignment of block devices
|
|
@{run}/udev/data/b248:[0-9]* r, # for dynamic kernel assignment of block devices
|
|
@{run}/udev/data/b247:[0-9]* r, # for dynamic kernel assignment of block devices
|
|
@{run}/udev/data/b246:[0-9]* r, # for dynamic kernel assignment of block devices
|
|
@{run}/udev/data/b245:[0-9]* r, # for dynamic kernel assignment of block devices
|
|
@{run}/udev/data/b244:[0-9]* r, # for dynamic kernel assignment of block devices
|
|
@{run}/udev/data/b243:[0-9]* r, # for dynamic kernel assignment of block devices
|
|
@{run}/udev/data/b242:[0-9]* r, # for dynamic kernel assignment of block devices
|
|
@{run}/udev/data/b241:[0-9]* r, # for dynamic kernel assignment of block devices
|
|
@{run}/udev/data/b240:[0-9]* r, # for dynamic kernel assignment of block devices
|
|
@{run}/udev/data/b259:[0-9]* r,
|
|
|
|
@{run}/udev/data/b179:[0-9]* r, # for /dev/mmcblk*
|
|
@{run}/udev/data/b11:[0-9]* r, # for /dev/sr*
|
|
@{run}/udev/data/b8:[0-9]* r, # for /dev/sd*
|
|
@{run}/udev/data/b7:[0-9]* r, # for /dev/loop*
|
|
|
|
@{run}/udev/data/c189:[0-9]* r, # for /dev/bus/usb/**
|
|
|
|
@{run}/udev/data/+usb:* r, # for ?
|
|
|
|
include if exists <abstractions/disks-write.d> |