mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2025-01-15 08:47:48 +01:00
72 lines
1.6 KiB
Text
72 lines
1.6 KiB
Text
# apparmor.d - Full set of apparmor profiles
|
|
# Copyright (C) 2023-2024 Alexandre Pujol <alexandre@pujol.io>
|
|
# SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
# Profile for generic systemd unit services. Only used by tiny systemd services
|
|
# that start a shell or use context specific programs.
|
|
|
|
# It does not specify an attachment path because it is intended to be used only
|
|
# via "Px -> systemd-service" exec transitions from the systemd profile.
|
|
|
|
abi <abi/4.0>,
|
|
|
|
include <tunables/global>
|
|
|
|
profile systemd-service flags=(attach_disconnected) {
|
|
include <abstractions/base>
|
|
include <abstractions/consoles>
|
|
include <abstractions/nameservice-strict>
|
|
|
|
capability chown,
|
|
capability fsetid,
|
|
|
|
@{bin}/ldconfig rix,
|
|
@{bin}/savelog rix,
|
|
@{bin}/systemctl rix,
|
|
@{bin}/gzip rix,
|
|
@{coreutils_path} rix,
|
|
@{sh_path} rmix,
|
|
|
|
# ifup@.service
|
|
@{bin}/ifup rPx,
|
|
|
|
# shadow.service
|
|
@{bin}/pwck rPx,
|
|
@{bin}/grpck rPx,
|
|
|
|
@{bin}/grub-editenv rPx,
|
|
@{bin}/ibus-daemon rPx,
|
|
|
|
@{bin}/* r,
|
|
@{lib}/ r,
|
|
|
|
/var/cache/ldconfig/{,**} rw,
|
|
|
|
/boot/grub/grubenv rw,
|
|
/boot/grub/ w,
|
|
|
|
/var/log/ r,
|
|
/var/log/dmesg rw,
|
|
/var/log/dmesg.* rwl -> /var/log/dmesg,
|
|
|
|
# man-db.service
|
|
/usr/{,local/}share/man/{,**} r,
|
|
/etc/manpath.config r,
|
|
/var/cache/man/{,**} rwk,
|
|
|
|
# snapd.system-shutdown.service
|
|
@{run}/initramfs/shutdown rw,
|
|
@{run}/initramfs/ rw,
|
|
|
|
# cockpit.socket
|
|
@{run}/cockpit/@{rand8} rw,
|
|
@{run}/cockpit/motd w,
|
|
|
|
@{PROC}/cmdline r,
|
|
@{PROC}/sys/kernel/osrelease r,
|
|
|
|
include if exists <usr/systemd-service.d>
|
|
include if exists <local/systemd-service>
|
|
}
|
|
|
|
# vim:syntax=apparmor
|