apparmor.d/profiles/hardinfo
2021-04-01 16:17:47 +01:00

195 lines
4.6 KiB
Text

# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}bin/hardinfo
profile hardinfo @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
include <abstractions/gtk>
include <abstractions/fonts>
include <abstractions/fontconfig-cache-read>
include <abstractions/freedesktop.org>
include <abstractions/nameservice-strict>
include <abstractions/user-download-strict>
include <abstractions/python>
# This is needed to display some content of devices -> resources
capability sys_admin,
# This is for benchmarks
capability sys_nice,
network inet dgram,
network inet6 dgram,
network inet stream,
network inet6 stream,
@{exec_path} mrix,
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/locale rix,
/{usr/,}bin/ldd rix,
/{usr/,}bin/tr rix,
/{usr/,}bin/python2.[0-9]* rix,
/{usr/,}bin/python3.[0-9]* rix,
/{usr/,}bin/perl rix,
/{usr/,}bin/ruby2.[0-9]* rix,
/{usr/,}bin/make rix,
/{usr/,}bin/strace rix,
/{usr/,}bin/gdb rix,
/{usr/,}bin/last rix,
/{usr/,}bin/iconv rix,
/{usr/,}sbin/route rix,
/{usr/,}bin/valgrind{,.bin} rix,
/{usr/,}lib/@{multiarch}/valgrind/memcheck-*-linux rix,
/{usr/,}bin/lsb_release rPx -> child-lsb_release,
/{usr/,}bin/xdg-open rCx -> open,
/{usr/,}bin/ccache rCx -> ccache,
/{usr/,}bin/kmod rCx -> kmod,
/{usr/,}bin/glxinfo rPx,
/{usr/,}bin/xdpyinfo rPx,
/{usr/,}bin/lspci rPx,
/{usr/,}bin/lsusb rPx,
/{usr/,}bin/netstat rPx,
/{usr/,}bin/qtchooser rPx,
/{usr/,}lib/jvm/java-[0-9]*-openjdk-amd64/bin/javac rCx -> javac,
/usr/share/hardinfo/{,**} r,
@{sys}/class/power_supply/ r,
@{sys}/class/thermal/ r,
@{sys}/bus/i2c/drivers/eeprom/ r,
@{sys}/devices/system/cpu/** r,
@{sys}/devices/virtual/dmi/id/* r,
@{sys}/devices/virtual/thermal/thermal_zone[0-9]/hwmon[0-9]/temp* r,
@{sys}/devices/virtual/thermal/thermal_zone[0-9]/temp* r,
@{sys}/devices/platform/**/hwmon/hwmon[0-9]*/temp* r,
@{sys}/devices/platform/**/hwmon/hwmon[0-9]*/fan* r,
@{sys}/devices/pci[0-9]*/**/eeprom r,
@{sys}/devices/pci[0-9]*/**/hwmon/hwmon[0-9]*/temp* r,
@{sys}/devices/**/power_supply/** r,
@{PROC}/@{pid}/net/wireless r,
@{PROC}/@{pid}/net/dev r,
@{PROC}/@{pid}/net/arp r,
owner @{PROC}/@{pid}/fd/ r,
owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/mounts r,
@{PROC}/@{pids}/loginuid r,
@{PROC}/uptime r,
@{PROC}/loadavg r,
@{PROC}/ioports r,
@{PROC}/iomem r,
@{PROC}/dma r,
@{PROC}/asound/cards r,
@{PROC}/scsi/scsi r,
@{PROC}/bus/input/devices r,
@{PROC}/sys/kernel/random/entropy_avail r,
@{PROC}/@{pids}/net/route r,
/etc/fstab r,
/etc/exports r,
/etc/samba/smb.conf r,
/etc/gdb/gdbinit.d/ r,
/usr/share/gdb/python/ r,
/usr/share/gdb/python/** r,
/var/log/wtmp r,
owner @{HOME}/.hardinfo/ rw,
owner /tmp/#[0-9]*[0-9] rw,
# Allowed apps to open
/{usr/,}lib/firefox/firefox rPUx,
# Silencer
deny /usr/share/gdb/python/** w,
# file_inherit
owner /dev/tty[0-9]* rw,
profile ccache {
include <abstractions/base>
/{usr/,}bin/ccache mr,
/{usr/,}bin/{,@{multiarch}-}gcc-[0-9]* rix,
/media/ccache/*/** rw,
}
profile javac {
include <abstractions/base>
include <abstractions/nameservice-strict>
/{usr/,}lib/jvm/java-[0-9]*-openjdk-amd64/bin/* mr,
/{usr/,}lib/jvm/java-[0-9]*-openjdk-amd64/lib/** mr,
/etc/java-[0-9]*-openjdk/** r,
/usr/share/java/*.jar r,
owner @{PROC}/@{pid}/mountinfo r,
owner @{PROC}/@{pid}/cgroup r,
owner @{PROC}/@{pid}/coredump_filter rw,
@{sys}/fs/cgroup/{,**} r,
owner /tmp/hsperfdata_*/ rw,
owner /tmp/hsperfdata_*/@{pid} rw,
}
profile open {
include <abstractions/base>
include <abstractions/xdg-open>
/{usr/,}bin/xdg-open mr,
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}bin/gawk rix,
/{usr/,}bin/readlink rix,
/{usr/,}bin/basename rix,
owner @{HOME}/ r,
owner @{run}/user/[0-9]*/ r,
# Allowed apps to open
/{usr/,}lib/firefox/firefox rPUx,
# file_inherit
owner @{HOME}/.xsession-errors w,
}
profile kmod {
include <abstractions/base>
/{usr/,}bin/kmod mr,
@{sys}/module/** r,
@{PROC}/cmdline r,
@{PROC}/modules r,
@{PROC}/ioports r,
}
include if exists <local/hardinfo>
}