apparmor.d/profiles/child-dpkg
2021-04-01 16:17:47 +01:00

39 lines
1.1 KiB
Text

# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# SPDX-License-Identifier: GPL-2.0-only
# Note: This profile does not specify an attachment path because it is
# intended to be used only via "Px -> child-dpkg" exec transitions from
# other profiles. We want to confine the dpkg(1) utility when it
# is invoked from other confined applications, but not when it is used
# in regular (unconfined) shell scripts or run directly by the user.
abi <abi/3.0>,
include <tunables/global>
# Do not attach to /{usr/,}bin/dpkg by default
profile child-dpkg {
include <abstractions/base>
include <abstractions/consoles>
# Needed?
deny capability setgid,
/{usr/,}bin/dpkg mr,
# Do not strip env to avoid errors like the following:
# ERROR: ld.so: object 'libfakeroot-sysv.so' from LD_PRELOAD cannot be preloaded (cannot open
# shared object file): ignored.
/{usr/,}bin/dpkg-query rpx,
/etc/dpkg/dpkg.cfg.d/{,*} r,
/etc/dpkg/dpkg.cfg r,
/var/lib/dpkg/** r,
# file_inherit
/tmp/#[0-9]*[0-9] rw,
include if exists <local/child-dpkg>
}