mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2024-12-25 06:27:49 +01:00
81 lines
2.1 KiB
Text
81 lines
2.1 KiB
Text
# apparmor.d - Full set of apparmor profiles
|
|
# Copyright (C) 2020-2021 Mikhail Morfikov
|
|
# SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
abi <abi/3.0>,
|
|
|
|
include <tunables/global>
|
|
|
|
@{exec_path} = /{usr/,}bin/check-support-status
|
|
profile check-support-status @{exec_path} {
|
|
include <abstractions/base>
|
|
include <abstractions/consoles>
|
|
|
|
@{exec_path} rix,
|
|
/{usr/,}bin/{,ba,da}sh rix,
|
|
|
|
/{usr/,}bin/ r,
|
|
/{usr/,}bin/gettext.sh r,
|
|
/{usr/,}bin/cat rix,
|
|
/{usr/,}bin/{,e}grep rix,
|
|
/{usr/,}bin/cut rix,
|
|
/{usr/,}bin/date rix,
|
|
/{usr/,}bin/getopt rix,
|
|
/{usr/,}bin/fold rix,
|
|
/{usr/,}bin/mktemp rix,
|
|
/{usr/,}bin/rm rix,
|
|
/{usr/,}bin/awk rix,
|
|
/{usr/,}bin/comm rix,
|
|
/{usr/,}bin/mkdir rix,
|
|
/{usr/,}bin/mv rix,
|
|
/{usr/,}bin/find rix,
|
|
/{usr/,}bin/wc rix,
|
|
/{usr/,}bin/basename rix,
|
|
/{usr/,}bin/gawk rix,
|
|
/{usr/,}bin/sort rix,
|
|
/{usr/,}bin/head rix,
|
|
/{usr/,}bin/gettext rix,
|
|
/{usr/,}bin/sed rix,
|
|
/{usr/,}bin/envsubst rix,
|
|
/{usr/,}bin/dirname rix,
|
|
|
|
# Do not strip env to avoid errors like the following:
|
|
# ERROR: ld.so: object 'libfakeroot-sysv.so' from LD_PRELOAD cannot be preloaded (cannot open
|
|
# shared object file): ignored.
|
|
/{usr/,}bin/dpkg-query rpx,
|
|
|
|
/{usr/,}bin/dpkg rPx -> child-dpkg,
|
|
|
|
/{usr/,}bin/debconf-escape rCx -> debconf-escape,
|
|
|
|
/etc/debian_version r,
|
|
|
|
# For shell pwd
|
|
/ r,
|
|
owner @{HOME}/ r,
|
|
|
|
/tmp/ r,
|
|
owner /tmp/debian-security-support.*/{,**} rw,
|
|
/tmp/debian-security-support.postinst.*/output w,
|
|
|
|
/var/lib/debian-security-support/ r,
|
|
owner /var/lib/debian-security-support/security-support.semaphore rw,
|
|
owner /var/lib/debian-security-support/tmp.* rw,
|
|
|
|
/usr/share/debian-security-support/ r,
|
|
/usr/share/debian-security-support/* r,
|
|
|
|
|
|
profile debconf-escape {
|
|
include <abstractions/base>
|
|
include <abstractions/perl>
|
|
|
|
/{usr/,}bin/debconf-escape r,
|
|
/{usr/,}bin/perl r,
|
|
|
|
owner /tmp/debian-security-support.postinst.*/output r,
|
|
|
|
}
|
|
|
|
include if exists <local/check-support-status>
|
|
}
|