mirror of
https://github.com/roddhjav/apparmor.d.git
synced 2024-12-25 06:27:49 +01:00
166 lines
4 KiB
Text
166 lines
4 KiB
Text
# apparmor.d - Full set of apparmor profiles
|
|
# Copyright (C) 2019-2021 Mikhail Morfikov
|
|
# SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
abi <abi/3.0>,
|
|
|
|
include <tunables/global>
|
|
|
|
@{exec_path} = /{usr/,}sbin/mkinitramfs
|
|
profile mkinitramfs @{exec_path} {
|
|
include <abstractions/base>
|
|
include <abstractions/consoles>
|
|
|
|
capability syslog,
|
|
capability chown,
|
|
capability fowner,
|
|
capability fsetid,
|
|
|
|
@{exec_path} r,
|
|
/{usr/,}bin/{,ba,da}sh rix,
|
|
|
|
/{usr/,}sbin/ r,
|
|
/{usr/,}bin/ r,
|
|
/{usr/,}lib/ r,
|
|
/{usr/,}lib64/ r,
|
|
|
|
/{usr/,}bin/getopt rix,
|
|
/{usr/,}bin/basename rix,
|
|
/{usr/,}bin/{,e}grep rix,
|
|
/{usr/,}bin/touch rix,
|
|
/{usr/,}bin/readlink rix,
|
|
/{usr/,}bin/mktemp rix,
|
|
/{usr/,}bin/chmod rix,
|
|
/{usr/,}bin/ln rix,
|
|
/{usr/,}bin/mkdir rix,
|
|
/{usr/,}bin/cp rix,
|
|
/{usr/,}bin/cat rix,
|
|
/{usr/,}bin/dirname rix,
|
|
/{usr/,}bin/sed rix,
|
|
/{usr/,}bin/tsort rix,
|
|
/{usr/,}bin/rm rix,
|
|
/{usr/,}bin/id rix,
|
|
/{usr/,}bin/sort rix,
|
|
/{usr/,}bin/env rix,
|
|
/{usr/,}bin/rmdir rix,
|
|
/{usr/,}bin/tr rix,
|
|
|
|
/{usr/,}bin/cpio rix,
|
|
/{usr/,}bin/gzip rix,
|
|
/{usr/,}bin/bzip2 rix,
|
|
/{usr/,}bin/lzma rix,
|
|
/{usr/,}bin/lzop rix,
|
|
/{usr/,}bin/xz rix,
|
|
/{usr/,}bin/zstd rix,
|
|
|
|
/{usr/,}bin/ldd rCx -> ldd,
|
|
/{usr/,}sbin/ldconfig rCx -> ldconfig,
|
|
/{usr/,}bin/find rCx -> find,
|
|
/{usr/,}bin/kmod rCx -> kmod,
|
|
|
|
/{usr/,}bin/dpkg rPx -> child-dpkg,
|
|
/{usr/,}bin/linux-version rPx,
|
|
|
|
# What to do with it? (#FIXME#)
|
|
/usr/share/initramfs-tools/hooks/* rPUx,
|
|
/usr/share/initramfs-tools/scripts/*/* rPUx,
|
|
/etc/initramfs-tools/hooks/* rPUx,
|
|
/etc/initramfs-tools/scripts/*/* rPUx,
|
|
|
|
/usr/share/initramfs-tools/{,**} r,
|
|
/etc/initramfs-tools/{,**} r,
|
|
|
|
# For shell pwd
|
|
/ r,
|
|
/etc/ r,
|
|
/root/ r,
|
|
|
|
/etc/modprobe.d/{,*.conf} r,
|
|
|
|
/boot/ r,
|
|
owner /boot/initrd.img-*.new rw,
|
|
|
|
/var/tmp/ r,
|
|
owner /var/tmp/mkinitramfs_*/ rw,
|
|
owner /var/tmp/mkinitramfs_*/** rwl -> /var/tmp/mkinitramfs_*/**,
|
|
/var/tmp/mkinitramfs_*/usr/lib/modules/*/modules.{order,builtin} rw,
|
|
owner /var/tmp/mkinitramfs-* rw,
|
|
|
|
@{PROC}/modules r,
|
|
|
|
|
|
profile ldd {
|
|
include <abstractions/base>
|
|
include <abstractions/consoles>
|
|
|
|
/{usr/,}bin/ldd mr,
|
|
|
|
/{usr/,}bin/kmod mr,
|
|
/{usr/,}bin/{,ba,da}sh rix,
|
|
|
|
/{usr/,}lib/@{multiarch}/ld-*.so rix,
|
|
/{usr/,}lib{,x}32/ld-*.so rix,
|
|
|
|
}
|
|
|
|
profile ldconfig {
|
|
include <abstractions/base>
|
|
include <abstractions/consoles>
|
|
|
|
capability sys_chroot,
|
|
|
|
/{usr/,}sbin/ldconfig mr,
|
|
|
|
owner /var/tmp/mkinitramfs_*/etc/ld.so.conf r,
|
|
owner /var/tmp/mkinitramfs_*/etc/ld.so.conf.d/{,*.conf} r,
|
|
|
|
owner /var/tmp/mkinitramfs_*/{usr/,}lib{,32,x32}/ r,
|
|
owner /var/tmp/mkinitramfs_*/{usr/,}lib/@{multiarch}/ r,
|
|
owner /var/tmp/mkinitramfs_*/{usr/,}lib/@{multiarch}/*.so* rw,
|
|
owner /var/tmp/mkinitramfs_*/{usr/,}lib{,32,x32}/*.so* rw,
|
|
|
|
owner /var/tmp/mkinitramfs_*/etc/ld.so.cache{,~} rw,
|
|
|
|
owner /var/tmp/mkinitramfs_*/var/cache/ldconfig/ rw,
|
|
owner /var/tmp/mkinitramfs_*/var/cache/ldconfig/aux-cache{,~} rw,
|
|
|
|
}
|
|
|
|
profile find {
|
|
include <abstractions/base>
|
|
include <abstractions/consoles>
|
|
|
|
/{usr/,}bin/find mr,
|
|
|
|
# pwd dir
|
|
/ r,
|
|
/etc/ r,
|
|
/root/ r,
|
|
|
|
/usr/share/initramfs-tools/scripts/{,**/} r,
|
|
/etc/initramfs-tools/scripts/{,**/} r,
|
|
|
|
owner /var/tmp/mkinitramfs_*/{,**/} r,
|
|
|
|
}
|
|
|
|
profile kmod {
|
|
include <abstractions/base>
|
|
include <abstractions/consoles>
|
|
|
|
/{usr/,}bin/kmod mr,
|
|
|
|
@{PROC}/cmdline r,
|
|
|
|
/etc/modprobe.d/ r,
|
|
/etc/modprobe.d/*.conf r,
|
|
|
|
owner /var/tmp/mkinitramfs_*/usr/lib/modules/*/ r,
|
|
owner /var/tmp/mkinitramfs_*/usr/lib/modules/*/modules.* rw,
|
|
owner /var/tmp/mkinitramfs_*/usr/lib/modules/*/kernel/{,**/} r,
|
|
owner /var/tmp/mkinitramfs_*/usr/lib/modules/*/kernel/**/*.ko r,
|
|
|
|
}
|
|
|
|
include if exists <local/mkinitramfs>
|
|
}
|