apparmor.d/profiles/mkinitramfs
2021-04-01 16:17:47 +01:00

166 lines
4 KiB
Text

# apparmor.d - Full set of apparmor profiles
# Copyright (C) 2019-2021 Mikhail Morfikov
# SPDX-License-Identifier: GPL-2.0-only
abi <abi/3.0>,
include <tunables/global>
@{exec_path} = /{usr/,}sbin/mkinitramfs
profile mkinitramfs @{exec_path} {
include <abstractions/base>
include <abstractions/consoles>
capability syslog,
capability chown,
capability fowner,
capability fsetid,
@{exec_path} r,
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}sbin/ r,
/{usr/,}bin/ r,
/{usr/,}lib/ r,
/{usr/,}lib64/ r,
/{usr/,}bin/getopt rix,
/{usr/,}bin/basename rix,
/{usr/,}bin/{,e}grep rix,
/{usr/,}bin/touch rix,
/{usr/,}bin/readlink rix,
/{usr/,}bin/mktemp rix,
/{usr/,}bin/chmod rix,
/{usr/,}bin/ln rix,
/{usr/,}bin/mkdir rix,
/{usr/,}bin/cp rix,
/{usr/,}bin/cat rix,
/{usr/,}bin/dirname rix,
/{usr/,}bin/sed rix,
/{usr/,}bin/tsort rix,
/{usr/,}bin/rm rix,
/{usr/,}bin/id rix,
/{usr/,}bin/sort rix,
/{usr/,}bin/env rix,
/{usr/,}bin/rmdir rix,
/{usr/,}bin/tr rix,
/{usr/,}bin/cpio rix,
/{usr/,}bin/gzip rix,
/{usr/,}bin/bzip2 rix,
/{usr/,}bin/lzma rix,
/{usr/,}bin/lzop rix,
/{usr/,}bin/xz rix,
/{usr/,}bin/zstd rix,
/{usr/,}bin/ldd rCx -> ldd,
/{usr/,}sbin/ldconfig rCx -> ldconfig,
/{usr/,}bin/find rCx -> find,
/{usr/,}bin/kmod rCx -> kmod,
/{usr/,}bin/dpkg rPx -> child-dpkg,
/{usr/,}bin/linux-version rPx,
# What to do with it? (#FIXME#)
/usr/share/initramfs-tools/hooks/* rPUx,
/usr/share/initramfs-tools/scripts/*/* rPUx,
/etc/initramfs-tools/hooks/* rPUx,
/etc/initramfs-tools/scripts/*/* rPUx,
/usr/share/initramfs-tools/{,**} r,
/etc/initramfs-tools/{,**} r,
# For shell pwd
/ r,
/etc/ r,
/root/ r,
/etc/modprobe.d/{,*.conf} r,
/boot/ r,
owner /boot/initrd.img-*.new rw,
/var/tmp/ r,
owner /var/tmp/mkinitramfs_*/ rw,
owner /var/tmp/mkinitramfs_*/** rwl -> /var/tmp/mkinitramfs_*/**,
/var/tmp/mkinitramfs_*/usr/lib/modules/*/modules.{order,builtin} rw,
owner /var/tmp/mkinitramfs-* rw,
@{PROC}/modules r,
profile ldd {
include <abstractions/base>
include <abstractions/consoles>
/{usr/,}bin/ldd mr,
/{usr/,}bin/kmod mr,
/{usr/,}bin/{,ba,da}sh rix,
/{usr/,}lib/@{multiarch}/ld-*.so rix,
/{usr/,}lib{,x}32/ld-*.so rix,
}
profile ldconfig {
include <abstractions/base>
include <abstractions/consoles>
capability sys_chroot,
/{usr/,}sbin/ldconfig mr,
owner /var/tmp/mkinitramfs_*/etc/ld.so.conf r,
owner /var/tmp/mkinitramfs_*/etc/ld.so.conf.d/{,*.conf} r,
owner /var/tmp/mkinitramfs_*/{usr/,}lib{,32,x32}/ r,
owner /var/tmp/mkinitramfs_*/{usr/,}lib/@{multiarch}/ r,
owner /var/tmp/mkinitramfs_*/{usr/,}lib/@{multiarch}/*.so* rw,
owner /var/tmp/mkinitramfs_*/{usr/,}lib{,32,x32}/*.so* rw,
owner /var/tmp/mkinitramfs_*/etc/ld.so.cache{,~} rw,
owner /var/tmp/mkinitramfs_*/var/cache/ldconfig/ rw,
owner /var/tmp/mkinitramfs_*/var/cache/ldconfig/aux-cache{,~} rw,
}
profile find {
include <abstractions/base>
include <abstractions/consoles>
/{usr/,}bin/find mr,
# pwd dir
/ r,
/etc/ r,
/root/ r,
/usr/share/initramfs-tools/scripts/{,**/} r,
/etc/initramfs-tools/scripts/{,**/} r,
owner /var/tmp/mkinitramfs_*/{,**/} r,
}
profile kmod {
include <abstractions/base>
include <abstractions/consoles>
/{usr/,}bin/kmod mr,
@{PROC}/cmdline r,
/etc/modprobe.d/ r,
/etc/modprobe.d/*.conf r,
owner /var/tmp/mkinitramfs_*/usr/lib/modules/*/ r,
owner /var/tmp/mkinitramfs_*/usr/lib/modules/*/modules.* rw,
owner /var/tmp/mkinitramfs_*/usr/lib/modules/*/kernel/{,**/} r,
owner /var/tmp/mkinitramfs_*/usr/lib/modules/*/kernel/**/*.ko r,
}
include if exists <local/mkinitramfs>
}